Do you have a T2 security chip?

My guess is that had I not done that and my internal drive died, I would not be able to boot into recovery from an external drive to fix it. I haven't checked to find a way round that in case you don't want to authorise it. Maybe a Network start over the internet. Just had a chat with an Apple advisor who like me, would hope that you'll be able to change that setting using Internet recovery, but couldn't actually find any documentation to prove it.
Oh, and yes, my clone now works. I'm also guessing my T2 chip will protect me unless I start from an external drive.