This current scenario is very likely Device Guard that limits the CA's that may be used, that it's not Secure Boot with its defaults. So the security benefit w

This current scenario is very likely Device Guard that limits the CA's that may be used, that it's not Secure Boot with its defaults. So the security benefit would be avoiding 3rd party and signed, but potentially vulnerable "bootloaders"