Maybe it is - boot loaders from disk have been used a long time before DOS, etc. Also, check how to boot (IPL) 360/370 from punched cards, console or tape instead of boot loader from disk which could also be modified. You actually were able to make the system load from almost any device. Or DEC or Tandem from front switches, or Univac 494, etc. It was fun and trust me, the security was taken very seriously, maybe not in all installations but at least where I was at that time. It just was more physical security than today, no mobiles! Misusing corporate information is nothing new, you had to watch your customer information, your "IP", etc very carefully even in centralized systems.