You're right, that is the right thing to do. However, MS also mandates that secure boot be enabled with no option to disable it on certified Windows RT devices

You're right, that is the right thing to do. However, MS also mandates that secure boot be enabled with no option to disable it on certified Windows RT devices. That's essentially all future ARM-based Windows devices, not just Surface RT, and I suspect we'll be seeing more of those in years to come.