[comex]

tldr: it's up to the OEMs whether or not to provide an (ugly and, considering the implication that other OSes are insecure, scary) option to disable secure boot.