This is accurate for Intel-based Macs but not for M1 or future Apple silicon Macs.
With Apple silicon Macs, there is no need to permit external booting (it is already enabled). This is because each boot volume has its own security policy, whether internal or external. When a new startup volume is connected (usually external), the Mac first reboots to recoveryOS and gets existing admin credentials in order to create a new security policy for that startup disk. More details can be found here (see the note at the end of the article): Startup Disk security policy control for a Mac with Apple silicon - Apple Support
With bootable installers in particular (as far as I'm aware), M1 Macs do not actually start up from the bootable installer; they only leverage the macOS installer stored on there. Everything else is accomplished directly from the internal recoveryOS.
Also, it is not possible to fully erase the internal drive using recoveryOS. This is due to the following:
- The default drive configuration for an M1 Mac contains three APFS Containers:
- Apple_APFS_iSC (disk0s1 / disk1, iBoot System Container): This APFS container is special and cannot be recreated outside of a DFU restore. It contains various firmware components and boot materials, including the LocalPolicy files.
- Apple_APFS (disk0s2 / disk3): This container contains a typical macOS installation, and can be freely erased.
- Apple_APFS_Recovery (disk0s3 / disk2): This container is special and cannot be recreated outside of a DFU restore. It contains System Recovery, a dedicated copy of macOS Recovery that exists even if disk0s2 gets erased. Removing this copy of macOS Recovery renders the Mac unbootable, requiring a DFU restore.
- macOS Recovery will not permit you to delete or erase disk0s1 or disk0s3 for safety reasons, rooted in the above descriptions. As a result, it will prevent any attempt to erase the top level of the internal drive. (Also, disk0s1 and disk0s3 are hidden from Disk Utility.)
To safely erase an M1 Mac:
The truly failsafe method
Restore the firmware. This is also the only true way to erase the entire internal drive. (The IPSW restore image will recreate the two special containers.)
The reasonable and failsafe method
- Shut down your M1 Mac.
- Press and hold the power button (or Touch ID) until Startup Options begins to load. This boots macOS Recovery.
- Select Options and click Continue. This continues into the recoveryOS.
- If you're prompted for an administrator password, skip to step 7.
- The utilities window should appear. At the top of the screen, select Utilities -> Terminal.
- Type "resetpassword" without the quotes and hit Enter (Return).
- The Recovery Assistant should launch. At the top of the screen, select Recovery Assistant -> Erase Mac.
- Follow the onscreen prompts to safely erase your Mac. (This preserves the two special containers.)
- Connect to the Internet to activate your Mac when prompted.
- When activation is successful, you should see the utilities window again. Select Install macOS and click Continue.
- Follow the onscreen instructions to install macOS.
If you want to use a bootable installer for installing macOS, skip steps 10-11, attach the bootable installer, complete steps 1-2 again, but select the bootable installer when prompted.
The Disk Utility method (not really recommended unless you don't want to erase everything)
- Shut down your M1 Mac.
- Press and hold the power button (or Touch ID) until Startup Options begins to load. This boots macOS Recovery.
- Select Options and click Continue. This continues into the recoveryOS.
- If you're prompted for an administrator password, enter it to continue.
- The utilities window should appear. Select Disk Utility and click Continue.
- Click the View button, then select Show All Devices.
- Choose the volume, container, or partition that you want to erase. In most cases, there is a single APFS container on the internal drive, housing one or more volumes. In this case, select that APFS container.
- Click Erase. Choose these options, then click Erase Volume Group. If that option isn't available, click Erase:
- Name: Macintosh HD
- Format: APFS
- You might be warned that you're about to erase your Mac. Confirm the prompt. Your Mac should then restart.
- Connect to the Internet to activate your Mac when prompted.
- When activation is successful, you should see the utilities window again. Select Install macOS and click Continue.
- Follow the onscreen instructions to install macOS.
Again, if you want to use a bootable installer for installing macOS, skip steps 11-12, attach the bootable installer, complete steps 1-2 again, but select the bootable installer when prompted.