The kernel isn't able to determine whether you booted in a verifiable manner in all cases, so there's functionality that allows the bootloader to make that decision rather than the kernel. But if you don't have a verified boot environment and someone is deliberately attacking you, it's easy for them to fake up your early boot environment such that the kernel believes it's booted securely even if it hasn't been.

If you want to protect against accidents then you can do that in userspace. There's no need for the kernel to be involved.

One would hope your system would complain loudly in the BIOS if Secure Boot wasn't on regardless of the operating system. If some malware manages to misconfigure Secure Boot, it can also patch your kernel to remove the complaining.