“All of this is happening in a perfectly sensible 32 bit mode, and the CPU actually switches back to the awful segmented configuration afterwards so it’s still compatible with an 80386 from 1986.”
A modern Intel chip waits for the Management Engine, a separate x86, to boot its own OS first. Then microcode verifies an Intel-signed module, uses cache as RAM, checks the firmware against a key hash burned into chipset fuses, and does all of it in 32-bit mode. Then it drops back to real mode. The firmware immediately switches out of real mode again. A chip with 5 orders of magnitude more transistors than the 8086 does this dance in case someone wants to boot DOS.