Microsoft has mandated that OEMs must provide a way for users to disable secure boot, and a way for them to add their own keys, however we still do not know the exact nature of what "turning it off" entails.
The Microsoft requirements are very vague on this point, if early hardware is indication, disabling it could be quite complicated and error prone, IE having to re flash the firmware.
The biggest problem IMO is Microsoft is completely free to change this requirement at any time, and with stuff like ARM already being mandated as having no way to disable secure boot, or load keys, I don't think this is particularly far fetched.
Also consider the fact they never mandated having a way to disable it previously, until there was a massive outcry.
The Microsoft requirements are very vague on this point, if early hardware is indication, disabling it could be quite complicated and error prone, IE having to re flash the firmware.
The biggest problem IMO is Microsoft is completely free to change this requirement at any time, and with stuff like ARM already being mandated as having no way to disable secure boot, or load keys, I don't think this is particularly far fetched.
Also consider the fact they never mandated having a way to disable it previously, until there was a massive outcry.