In theory, yes. There is a first-stage bootloader (that actually finds, loads, verifies, and jumps-into fastboot) baked into the hardware (implemented in fuses and ROMs [like REAL roms, not “flashable” ROMs]), and AFAIK it cannot effectively be modified after the phone is manufactured, so they try to keep it as simple as possible.

So if it were real, the psuedocode would be something like this:

var fastbootPartition=locateFastbootPartition();

if (fastbootPartition == null || !verifySignature(fastbootPartition))
{
     // AFAIK, this code block is already a thing in production, but the
    // message is more like a "signature failed" or "corrupted" than
    // a "you done goofed".
    displayRudeMessage();
    halt();
}

var fastbootAddress=load(fastBootPartition);
jumpTo(fastbootAddress);