Disclaimer. There is no proof that BadBIOS is real yet.
Removing the bios chip, and putting it in a SPI programmer would allow it to be reflashed. I'm pretty sure he didn't claim that could be blocked. But fairly often, the bios chip is simply not that easy to remove anymore. To reflash it you would have to boot something with the motherboard, and the motherboard's theoretical bios rootkit can intercept it, and trojan the flasher.
The trick BadBIOS supposedly did was prevent booting from any device it couldn't infect, like a cd-rom drive. That was the big tell.
If you attempted to boot to a secure flashing environment, if it was a read only device, the boot would be blocked, forcing you to use something it could exploit.
You use a usb flash drive? One with write protect? it still infects the firmware to install it's stealth and reflash protection. Cryptographically secure usb flash drive? it turns into a paperweight because the firmware modification is caught.
That was supposedly how it worked. The infections kept jumping to usb firmware, hard drive firmware, and bios firmware. and if they all aren't removed at the same time, each one reinstalls all the others. And with the difficulty of removing the bios chip on a modern motherboard, you pretty much have to trash the motherboard, and reflash everything else with a clean system.
You actually manage to flash the bios. did you get the boot drive's firmware too? If not, it's back inside the BIOS once you boot again.
This truly terrifying level of persistence is indeed possible. USB devices can be trojaned to detect when they are booted with, and modify their contents on the fly. The BadUSB team did a POC where a flash drive will trojan the Ubuntu installation files that are on it, but only when it's booted from. You could copy the files to the drive, and verify them with every hash and it would pass, but when you actually booted it, it would trojan the installers security, as well as place the backdoor in.
No verified BadUSB attack that's truly invisible that works on an already running PC has been verified yet that i know of. the keyboard trickery requires that you not be watching the screen and an unlocked PC. The ethernet card trickery requires that you visit the site its' replacing for you. But presumably this is what BadBIOS did. Silent infection of USB peripherals is possible, and conditionally modifying files on the usb itself is also possible, which can silently infect installs from said usb stick. but that's not quite enough to do what BadBIOS supposedly does just by plugging in an infected USB stick.