Ben N answer is clearly the most useful and clear one.
For those who still wonder, however here is the full story.
Virtualization is achieved with hardware assist from the CPU. Since a virtualized OS would interfere with the host one, as they compete for the same resources, a mechanism is needed to stop the guest from having uncontrolled access to the hardware.
This can be down with software, slow, techniques or with assist from the CPU.
Hardware assisted virtualization is implemented with specific, optional instructions, you can read about it in Chapters 23, 24, 25, 26, 27 and 28 of Intel Manual 3B Part 3.
Software must first check for this instructions to be supported, before attempting using them.
For security reason, the CPU has a special register, it is an MSR, called IA32_FEATURE_CONTROL that holds bits telling with feature to enable or disable.
Bit 0 is the lock bit. If this bit is clear, VMXON causes a general-protection exception. If the lock bit is set,
WRMSR to this MSR causes a general-protection exception; the MSR cannot be modified until a power-up reset
condition. System BIOS can use this bit to provide a setup option for BIOS to disable support for VMX. To
enable VMX support in a platform, BIOS must set bit 1, bit 2, or both (see below), as well as the lock bit.
The fundamental point is that once the register is locked, it cannot be unlocked until a power-up.
Since BIOS/UEFI comes first, it has the power to disable virtualization by clearing the appropriate bits and locking the register before any OS can prevent that.
When the virtualization feature is disabled this way, the CPU reports that it the optional instruction extension is missing (and actually faults if they are used) and so the software cannot use the hardware virtualization.