What would you do instead, if you were MS?

He would brick the Windows install and install Arch instead.

Not all "zero day" is created equally.

The vast majority of home users have never heard of secure boot, which defaults to off. Every corporate network I've walked into I have been the one to push it, as most have never heard of it. Both Microsoft and aws only recently introduced support in the cloud environments, so the majority of cloud hosted environments have not turned it on (which requires replacing the vm). It is far from almost everyone in the world who is even in a position to be impacted by a secure boot bypass.

Secure Boot is required to run Windows 11.

I think that’s inaccurate. Secure Boot capability is an install ‘requirement,’ but you definitely don’t have to switch it on.

I believe it defaults to on, at least on most systems designed to run Windows

There is literally no such thing as a "known zero-day". That is a contradiction in terms. Either it is unknown, and exploited as a zero-day, or it is known, and therefore no longer a zero-day at all.

This particular exploit requires either physical or admin access to the target computer, which takes a lot of the edge off.