Chromebooks are a great example of secure + customer friendly by default, with an option to go into very open mode.

(activate developer mode by proving physical control — in the past it was a screw, now it's sitting through a few minutes of pressing the power button when asked; from dev mode you can go further and flash custom CPU and EC firmware)