That last part requires a nudge and a wink, just like those OEMs who didn't "need" to make it annoying as fuck to turn off secure boot under the terms of their contract with Microsoft but did it anyway because they knew what was good for them.