It's probably worth mentioning that secure boot is trivially circumventable given physical access on any Intel Mac (including T2 Macs), so you want at least an M1 to feel safer here