I had a Asus Chromebox that did this and I actually always thought it was a good compromise. Still let me install my own OS with minimal hassle (case was well designed, screw was easy to get to), but normal users can get the security of a locked down bootloader.