>On the off chance that you're using secureboot without TPM + FDE, you'd be screwed anyways, because a bad guy could easily disable secureboot inside bios setti

>On the off chance that you're using secureboot without TPM + FDE, you'd be screwed anyways, because a bad guy could easily disable secureboot inside bios settings, or use shim loader to bypass it. You can defend against the bad guy disabling SB in the UEFI settings by password locking the UEFI setup. I don't know how common it is but all the mobos I've used for home PCs have such an option. Of course whether mobo manufacturers implement password locking correctly is another matter. Another line of defence is a chassis intrusion alarm to prevent the attacker from switching to alternate BIOSes and such, but those are normally only found in enterprise cases in my experience, and of course are not completely attacker-proof either. It's the standard bike lock tradeoff - perfect security is unattainable so you just put more and more roadblocks in the attacker's way to deter them hoping that they give up and go for an easier target. Although, unlike a bike lock, someone attacking your PC is probably doing a targeted attack anyway.