Hi Victor,
Regardless, if you want to add a PIN or code for first-time login, I would suggest adding it via the login screen. Something like:
1. Program the PIN/code into the Read-Only Vital Product Data (RO_VPD), which is a read-only region in the firmware ROM.
2. Modify the login manager to check if the machine is booting for the first time since it was last installed.
3. If so, the login manager can read the code from the RO_VPD (using the `vpd` tool in ChromeOS) and prompt the user to enter it. Once the user enters the code, the check is disabled (until the OS is re-installed or power washed).
Supporting firmware changes will be a very large task since there are long-term support implications. It will be much easier for you to support a change to the login screen I think.
Good luck!