https://docs.microsoft.com/en-us/windows/security/informatio...
>All x86-based Certified For Windows 10 PCs must meet several requirements related to Secure Boot:
> - They must have Secure Boot enabled by default.
> - They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
> - They must allow the user to configure Secure Boot to trust other bootloaders.
> - They must allow the user to completely disable Secure Boot.
The last two points in particular. It's been this way since SB was introduced.
Note that this requirement does not apply to non-x86 devices. In particular, ARM devices (Windows RT) are explicitly required to disallow SB from being disabled, to meet the certification requirement.
From 2012 until present, computers have been produced that run any EFI binary you want. Why not buy one of those? It's no different than sticking with pre-2012 machines, except you aren't attached to cruft from the 1980s anymore.
