And as for the "this explains then why ThinkPads must come with Windows" - no. It doesn't explain it. Secure boot has to be present on Windows certified machine, not the other way around. Lenovo can sell whatever they want (but apparently it's beneficial for them economically to only sell Windows machines).
Also, certified machine has to have secure boot disable-able. So it's not about you not being able to use the machine with Linux, it's about not being able to use Secure Boot with Linux.