I remember spending entire days trying to break the horrible ROM protect on those pieces of garbage when they first started popping up at every school district. Google got wise fast and separated write protect into its own software only flag inside the organizational stuff for any Chromebooks linked to a domain.
I did a nicer one recently which was a samsung chromebook which involved completely disassembling the entire thing and removing the heatsink just to be able to remove a tiny ass piece of conducting electric tape to disable write protect.
Even after that I had to very carefully rewrite the shitty google bootloader with libreboot if I wanted to run literally anything else without making a google approved kpart file which would only run on google’s compiled kernel.