It is fine to require signed updates, as long as the user can get their own updates installed. Usually that involves enrolling a new signing key, signing the up

It is fine to require signed updates, as long as the user can get their own updates installed. Usually that involves enrolling a new signing key, signing the updates with the user key and allowing user-signed updates. The shim tool used by Linux distros for Secure Boot is designed to allow that even if the UEFI firmware isn't and some UEFI implementations may allow controlling the signing keys. I expect that most of the cases you cite are simply outright GPL violations though.