On x86, Microsoft caved in and mandated (in Windows 8 Logo Requirements) that it must be possible to deactivate Secure Boot. My guess is that they were more con

On x86, Microsoft caved in and mandated (in Windows 8 Logo Requirements) that it must be possible to deactivate Secure Boot. My guess is that they were more concerned with Windows 7 using customers or hardware vendors that didn't want to build two lines of devices, one Windows 7, one Windows 8. On ARM, the Secure Boot rules are unchanged: mandantory, must not be deactivated. I somewhat expect Microsoft to switch the x86 side requirements back after Windows 7 support ends. Since this part of the behaviour isn't specified in UEFI specs but only in Windows Logo requirements, there's also exactly 0 leverage other market participants have over what's going on in that part of the PC platform, except maybe antitrust complaints - that easily take 5-10 years before there are any consequences.