I think it is only required on x86 EFI machines due to some old antitrust rulings. Provided the firmware vendor actually implements it right. On ARM for exampl

I think it is only required on x86 EFI machines due to some old antitrust rulings. Provided the firmware vendor actually implements it right. On ARM for example the hardware, including some hardware shipping with ARM version of Windows, does not need to provide the option to add custom certs and remove existing ones, so AFAIK in most cases it is not possible.