Microsoft sell locked down PCs today. Secure Boot cannot be disabled, nor new keys enrolled, on Windows PCs that ship with an ARM processor (yes they exist). It's as if Apple decided to lock down Macbooks when they switched to M-series. The only thing keeping PCs "free" is that ARM processors suck at the high end if you're not Apple, so it's seen as acceptable market segmentation. It's purely arbitrary though, just like it's purely arbitrary that you can put Linux on a Macbook but not an iPad despite having the same SoC.