Update BIOS on Thinkpads without Win or CD/DVD Drive
https://www.cyberciti.biz/faq/update-lenovo-bios-from-linux-usb-stick-pen/
http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk
In short:
Download Lenovo's Bootable BIOS Update CD ISO with wget ('wget -c URL'), install genisoimage ('sudo apt install genisoimage'), use geteltorito to extract image ('geteltorito -o thinkpad.img lenovo.iso') and burn image to USB with 'dd' ('sudo dd if=thinkpad.img of=/dev/sdX bs=64K').
Note:
--thinkpad.img = any name you choose to give the extracted file (eg. "x230.img)
--lenovo.iso = BIOS update ISO name for your computer from Lenovo's site
--/dev/sdX = where 'X' is your USB (find device name: 'lsblk'), eg. /dev/sdb
BIOS update in process. I wish they had Libreboot on these machines. The saving grace is, you don't need Windows to update the BIOS.
If there is no Boot Guard, then flashing the UEFI firmware itself is not a big problem with programming tools.
The real problem is the EC. It seems that the EC can only be updated using official UEFI/BIOS update tools, either as a CD-ROM image or a Losedows utility.
Anyway, thank you very much for sharing this workaround.