>On the other hand, Microsoft could have easily gotten a much more "robust" lockdown - by simply demanding mandatory, unchangeable Secure Boot like on the ARM tablets. But they didn't do that.

Didn't you hear that Secure Boot is basically broken?