The answer, in simple terms, is "yes" to all of your questions.
The firmware (BIOS or UEFI) loads before the operating system. Typically, it looks for a boot sector on your storage devices (internal HD, CD/DVD, USB drives, etc). Then it loads the bootloader specified in the boot sector into memory and passes control to that boot loader, which will get the rest of the operating system up and running.
If the firmware is infected with malicious code, it can read/write anywhere. File permissions are implemented by the OS kernel or the file system driver, so they aren't a concern at all in this situation. This means that you are free to tamper with the OS files as well.
But also, no.
In modern systems, this is very difficult to accomplish, however.
The firmware controls access to the EEPROM, which is where its code is stored. Modern motherboards will usually only accept firmware updates which have been digitally signed by the manufacturer. You would have to defeat this mechanism first if you wanted to tamper with the BIOS/UEFI.
Newer operating systems can validate digital signatures on their files. If you tamper with their files, the digital signature will no longer be valid. E.g., if you enable SecureBoot on Windows 10 and change something it will refuse to boot.
Obviously, you could edit the OS to strip out the digital signature checks if you control the firmware, but it is very difficult to infect firmware for several reasons.
In addition to the built-in protections, the firmware on most motherboards is customized for that individual model or, at most, that particular product line. Writing a firmware hack that applies to a wide range of motherboards is extremely difficult---and may be practically impossible.
All things considered...
It is theoretically possible to tamper with a system in this fashion. The potential for abuse is well understood, however, so the danger is addressed with reasonable technical measures.
People with physical access to your machines could flash the EEPROM chips containing the BIOS code with custom-programmed malware. It takes a lot of resources to orchestrate this, so the average computer user is not at risk.
This type of attack is easily within reach of governments and large criminal organizations. Governments and large firms are at risk, and they generally buy from trusted vendors or certified resellers to reduce the risk of acquiring compromised equipment.