Currently, unlike all the other lua files involved in computer startup, bios.lua is inaccessible from an in-game computer, and needs to be downloaded from the CC:T GitHub or a similar source. This is problematic for users trying to figure out how a function defined in bios.lua works (print, read, etc.), or programs which need to access bios.lua's source code (sandbox programs or debuggers). Such programs need to implement code to download the correct version of bios.lua from GitHub, which could also be incorrect if the server is running a custom datapack.

Moving bios.lua to the rom folder would simplify these use-cases. It could probably be moved to rom/bios.lua, since there's already a precedent of lua files being stored directly in the rom folder (rom/startup.lua).

(Due to datapack compatibility, this might have to be changed with a major Minecraft version?
Or CC:T could load the lua/bios.lua resource if it exists, otherwise load lua/rom/bios.lua)

Retaining the compatibility measure of loading bios.lua first then rom/bios.lua could allow secrets to continue to be stored. However, this measure would mean rom/bios.lua wouldn't reflect the actual code being loaded, unless the rom mount redirected rom/bios.lua to bios.lua as you suggest, which would make secret storage impossible. But providing the closest possible version of the bios.lua code rather than the exact server-modified version running might be good enough for many use-cases, like sandbox creation or in-game code viewing.
It would be more reliable for servers to just write a separate mod to store API tokens, but unfortunately, many server owners do not want to write mods.

btw you can just simply decompress the mod, and bios.lua is under the resources folder

For clarification, I am referring to the use-case of accessing bios.lua from an in-game computer. Downloading and decompressing the jar would be substantially more difficult than downloading from GitHub.

btw you can just simply decompress the mod, and bios.lua is under the resources folder

2 things that come to my mind is fact that:

1. This would allow user to see if server they are playing modified bios.lua or not. I am not sure if this is something really needed but it would be neat thing to provide for users.
2. This could be implemented without needing to make any breaking changes by just making file system api that handles rom just display bios.lua file in rom/bios.lua while file itself stays where it always was in source code.

On other hand i am not exactly sure if this is something that is truly needed and i do know that some CC servers kept stuff in bios.lua that they didn't want to be openly visible to all users like API tokens (Yes this stuff was still visible to those who know how to use debug lib but you see my point)