Secure Boot sits at the point where firmware and operating system trust intersect, and it decides what code is allowed to start the machine. Most systems treat it like background plumbing, but it has a direct influence on Linux security best practices because it defines whether the kernel you think you are running is actually the one that loads. When it works as intended, it gives you a predictable baseline for the rest of the stack. When it doesn't, the failure usually shows up in places that are hard to diagnose and even harder to monitor.

Source: Secure Boot: Strengthening Linux System Integrity from the Firmware Up