What's the earliest boot stage in android that can be compromised if there is so, then how does it work and what can be done about it?

The earliest I know of is it's possible to unlock the bootloader and flash the operating system with a malicious one