Comment by my123

> Wasn't there a line of MS Surface devices where secure boot could not be disabled, and users were stuck with Windows?

All Windows RT devices (32-bit Arm desktop Windows). Not only Secure Boot was locked down there, but apps had to be signed by Microsoft.

64-bit Windows on Arm adopts the security policy of x86_64 Windows, which means that you can turn off Secure Boot on production hardware. (and run your regular apps too)