The idea of secure boot could theoretically be a no-tradeoff security positive, but the implementation would be quite different from what it is currently. For starters, any non-user-hostile solution is going to have something like a usb device header on the motherboard as the highest-privileged interface to the system (with something like mandatory time delays to prevent against evil maid attacks). But to large manufacturers run by business people, the attraction to a hardcoded manufacturer-administered signing certificate for the trust root (which obviously erodes the owner's control) is just too strong for us to see a proper implementation any time soon.