“There’s no security benefit to this.”
The ThinkPad Z13 ships distrusting Microsoft’s own third-party UEFI key, so Linux won’t boot off a USB stick out of the box. Lenovo says Microsoft’s Secured-Core PC rules require it. A change to PCR 7 already catches a swapped bootloader, so the default protects nothing. It just makes Windows the only OS that works on a laptop you paid for.