That is actually the case. Point 17 states: Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to se

That is actually the case. Point 17 states: Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard".