On x86 it's debatable, but on ARM it absolutely is. When ARM PCs first started coming out, Microsoft jumped on the opportunity by forbidding OEMs from letting you disable Secure Boot on them or add your own keys to them. (And when Microsoft signs third-party things like shim, they do so with a different key than they sign Windows with, which isn't one they allow ARM OEMs to trust.)