DRTM, SMM attestation and remote attestation have evil maid attacks in their threat model, with a firmware TPM or SoC enclave that isn't subject to mitm.
Password keystroke surveillance (from sniffer, optical cameras or RF WiFi Sensing) can be mitigated by removable 2FA/smartcard.
Automatically clear some memory when the laptop is opened so the BIOS can tell.
Put important parts inside an epoxy. Add some transformer wire in the epoxy that will break when somebody tries to tamper with it.
I'm not trying to be exhaustive. But stuff like that.