I’m assuming the external booting prohibition setting is meant for USB-C sticks, so Cmd-R (Recovery) booting would work, correct?
But what if Recovery got corrupted, would Option-Cmd-R be able to boot a T2 Mac if I set the security to prohibit external booting?