NucU,
Yes, that is correct. If you have a stock BIOS update to install, no prompt for permission to install it will be generated. It is only when you make a change in the BIOS configuration and attempt to install the resulting BIO file (or the resulting EXE file if you have ITK generate one) that you will be forced to provide permission before the install will complete.
If you are in a position where you want to have the BIOS secured with a password and the machine placed in remote location, you are going to have problems. In this case, the best solution is to purchase NUC designs that include Intel(R) vPro(TM) support. With vPro support, you can redirect a unit's console I/O to a remote station across the W/LAN...
...Scott