Computers used to work this way.

You could even ship the computer with the USB stick pre-installed.

And this wouldn’t be impossible with Apple hardware; it has a bootloader built in that can boot from any functional and signed OS; could be Apple supplied, or something like Asahi. Or, with such a rule in place, they may also be required to not get in the way of installing other OSes and have to fully document the boot process and driver registration process, preventing signature-based lockdown completely.