You've missed the point. If they are enabled by default or display a message elsewhere is irrelevant, the fact is they don't display a watermark when the user i

You've missed the point. If they are enabled by default or display a message elsewhere is irrelevant, the fact is they don't display a watermark when the user is using the less secure option. Also I specifically referred to the built-in administrator which is not like a normal administrator account as everything it executes has elevated privileges. Yes, all of those have nothing to do directly with the boot sequence. But again, that is not the point. They all help prevent the malware from executing or gaining hold in the first place, before it has the chance to compromise the boot sequence. Secure boot does nothing to stop the malware in the first instance, just prevents it from messing with anything at boot. In my view, I'd say that actively defending from the malware is far better than reacting after the event to limit the impact. I'm not saying secure boot is not helpful but rather the current level of notification you get when it is disabled is disproportionate.