I genuinely struggling to see how TPM or SecureBoot improves security for normal users. The vast majority of attacks are not done by evil maids, but by zero-day

I genuinely struggling to see how TPM or SecureBoot improves security for normal users. The vast majority of attacks are not done by evil maids, but by zero-days, poorly configured software, or being phised.