New Macintoshes come with an Apple-produced "security chip", which is an ARM like those found in iPhones and iPads. They communicate with the main CPU and provide it the boot code via SPI for security, but the security chip itself has an entirely cryptographically signed boot chain and will only boot Apple-provided code.

The presumption is that when enough time has passed that Apple will obsolete the non-security-chip-equipped macs and macOS will only boot when able to communicate with a security chip running Apple-signed code. It's quite plausible. The security chip does provide a ton of other benefits, though.