Arm world is weird. You can have server (expensive, UEFI, out of the box supported by any mainline distribution, normal SATA/NVME storage) or SBC (cheap, usually U-Boot, not supported for months by any distribution, microsd/USB storage mostly). But I do not want to talk about servers today.
Bootloader(s) mess
So SBC… Which means playing with U-Boot. In the past it meant random fork of it. I have a feeling (can be wrong) that it changed. Board starts with mainline one or quite fresh fork with mainlining in progress. Similar with ATF (Arm Trusted Firmware - level0 bootloader).
So you have SBC, you have bootloader(s) built. The next step is taking microsd card, finding out which offsets to use. Then put bootloader(s) at proper places so CPU can read them and boot. Usually it also means that you have to use MBR style formatting as bootloader is where GPT would be.
Better way maybe?
Is there a better way? Sure it is. But it is very expensive. Or at least I have a feeling that it is for most of SBC vendors.
Very expensive solution
The solution is SPI flash chip. But it is very expensive - 3 (three) EUR for 512Mb (64MB) chip (if bought 1000 of them). Far too much for 99.99% of SBC probably.
Price taken from simple search on Digikey: W25Q512JV 512 Mb Serial Flash Memory.
64 megabytes is more than enough to store all. Bootloader(s), U-Boot/UEFI settings etc. You can even fit small OS image there.
Probably 64/128Mb will be enough even. And they are cheaper (128Mb is 1.7 EUR). Still too expensive…