Yeah, Secure Boot/Measured Boot is also needed to resist against persistent compromise in the virtual world, which is arguably much more problematic and has a m

Yeah, Secure Boot/Measured Boot is also needed to resist against persistent compromise in the virtual world, which is arguably much more problematic and has a much longer history of actual application in the wild. Chromebooks for example are designed so that even with a full system wide exploit that compromises the kernel, a reboot will return the system to a consistent and uncompromised state. (An interesting parallel is in the mobile ecosystem where things like untethered jailbreaks, i.e. persistent ones, for high end targets are nearly non-existent. Similarly, existing attacks from things like Cellebrite for high-end devices like Pixel/iPhones are generally classified in terms of things like whether they are vulnerable before or after first unlock of the device where boot chain security is strongest, and there's nearly nothing in terms of persistent compromise, downgrade/replay attacks, etc.)