The requirement to disallow users disabling UEFI Secure Boot on ARM, applies to the Windows hardware certification spec. There's no requirement that a vendor mu

The requirement to disallow users disabling UEFI Secure Boot on ARM, applies to the Windows hardware certification spec. There's no requirement that a vendor must follow that spec in order for the hardware to run Windows. It is a spec designed to tie co-marketing of Windows and your product, e.g. "made for Windows" with minimum compatibility standards (or at least Microsoft's idea of minimums). For example it also requires a TPM 2.0 be present and enabled.