The open source feature of Secureboot is true only if you have replaced the laptop firmware with Coreboot, which is compatible only with few, mostly old, laptops.
Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, at least for the auxiliary CPUs of Intel and AMD (ME/PSP) and for the CPU of the TPM, i.e. for the parts that are the most important for security.
If someone steals the device, I cannot see any difference between our 2 setups. In both cases, the thiefs can use the laptop, but without accessing the internal SSD/HDD, unless they format it, which will remove any of the original information stored on it.
Even if you configured a laptop with UEFI/SecureBoot to not display the boot device selection menu without a password and to not boot from the internal SSD without a password, that can stop only someone with momentary access to the device, the same as in my setup, where an intruder would see the error message that no bootable disk has been found. Thiefs will erase the non-volatile UEFI settings, so they will be able to boot your laptop from an external device, regardless of your configuration, but the original internal SSD/HDD will remain inaccessible in any of the 2 setups.
However in the case that relies on the internal firmware and TPM to protect the keys, there are more sophisticated hardware attacks against the motherboard, e.g. using fault injections, logic analyzers, desoldering the relevant chips and replacing them, etc., which may succeed in some cases. Such hardware attacks are impossible when the component that must be attacked is not present, because it is a removable key (which is temporarily inserted only during booting).
