They can turn those knobs anyway, you need something like Secure Boot and measured boot to ensure an untampered environment. Simple encryption doesn't provide

They can turn those knobs anyway, you need something like Secure Boot and measured boot to ensure an untampered environment. Simple encryption doesn't provide this. An attacker can just as well replace your GRUB. An encrypted boot partition is extremely rare in practice. It's not done by any installers. It's not the FDE people complaining about this think they've enabled.