I think the basic idea is that with physical access in general, the attacker may have an N% chance of accessing it. The adage about physical access isn't to gua

I think the basic idea is that with physical access in general, the attacker may have an N% chance of accessing it. The adage about physical access isn't to guarantee they will get access, just that you must consider it as such and react appropriately. The adage isn't a declaration of the state of the machine, it's a declaration on how to respond to its loss. With a backdoor via any means, the attackers now basically have (N+1)% chance of getting that access, and arguably it's much more than a single increment since whereas other exploits "might" exist, these ones will guaranteed exist. The suggestion and complaint isn't that "no secure boot is better than one that's easily bypassed", the complaint is requiring such a bypass and not giving the actual owners of the machine control over setting up that secure boot. With the RT devices, the user has absolutely no say in the secure boot process, and they're entirely dependent on Microsoft or whatever organization to provide best security practices. Also, If the user sets up their own key and does it wrong, they have only themselves to blame. If a company or government does it, the user has no one to blame, since often legal contracts prevent any reparations as result of damage done by stuff like this. The US Government, for reasons of varying validity, needs to give you permission to sue it, meaning they can eschew any complaints should they lose the key. All in all, a mandated backdoor just increases the chance that there will be a violation, takes control away from the user, and provides no compensation if the forced backdoor results in damages to the user.