[_jal]

Digression alert: I'm not talking about MBP-related stuff at all.

> So, no, the whole secure boot thing is just bullshit security theater and more lock in.

Only if you're only thinking about laptops, desktops, maybe phones and tablets. There are lots of types of machines out there physically exposed to users whom the machine-owners trust to varying degrees, ranging from "not at all" on up.

Think UPS package scanners, HVAC systems, various control systems in everything from warehouses to prisons, sensors and signage controls...

Now, Secure Boot doesn't address anywhere near anything close to "sufficient" in any of those environments, but it is one component of raising the costs of attacking them to a point to make the systems economically viable, or at least apparently so.