See your mobile phone: it depends whether the manufacturer makes that an option. In a processor I'm familiar with (imx53), once it's turned on by a processor fuse it stays on - it's then up to the second stage boot loader (provided by the device OEM) to decide whether to load untrusted images.