There's a few options: 1) Your kernel is in flash and your firmware won't update it unless it's signed. In that case the fact that there's no secure boot as su

There's a few options: 1) Your kernel is in flash and your firmware won't update it unless it's signed. In that case the fact that there's no secure boot as such is irrelevant, because you can assert that the hardware is providing a root of trust anyway 2) Your firmware measures the kernel into something like a TPM and the TPM won't release a secret that's required to boot unless that measurement is correct. https://mjg59.dreamwidth.org/35742.html https://mjg59.dreamwidth.org/35742.html describes a couple of shortcomings in that approach and how you can get around them - if you do that appropriately, there's no risk 3) Your system has some other kind of verified boot implementation (such as ChromeOS) But otherwise yes, that's the point - defaulting lockdown to on while it's still easy for an attacker to replace the kernel may not be a great default, because it removes functionality without offering much additional security.