Indeed, having done the whole developement/test/manufacturing workflow using hardware based secure boot , I realized likely very few people ever do it properly

Indeed, having done the whole developement/test/manufacturing workflow using hardware based secure boot , I realized likely very few people ever do it properly. We had developer keys and production keys. Burning one-time fuses with the production key meant developer code would be rejected. It took a high amount of discipline and a lot of work in the build process (separate developer/production builds of components and corresponding signing). Very few people had access to the production signing mechanism and I avoided signing root enabled builds, even though such would be extremely convenient. Other teams… freely published production signed internal use developer firmware internally (to the whole company). Sadly, nobody gets an award for doing it right, and rarely face consequences for doing it wrong.