The point is that any company can sign a rootkit (for the price of $99) to run on windows machines with our without SecureBoot. The best MS can do is to revoke certificates of rogue companies but by then the damage could be done.

In fact, as that Wikipedia article points out, it was exposed by a Microsoft employee:

The scandal erupted on October 31, 2005, when Microsoft researcher Mark Russinovich posted to his blog a detailed description and technical analysis of F4I's XCP software that he ascertained had been recently installed on his computer by a Sony BMG music CD. Russinovich compared the software to a rootkit due to its surreptitious installation and its efforts to hide its existence. He noted that the EULA does not mention the software, and he asserted emphatically that the software is illegitimate and that digital rights management had "gone too far".