Did you try disabling it in shim-signed instead of the BIOS (method 2 on this page [1])? I'd expect that to be more consistent and/or reliable since BIOS quality can vary a lot from vendor to vendor.

You might also try signing the kernel module yourself (the manual method at the bottom of that page)?

[1] https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS