> I’ve never understood secure boot. [...] I don’t really understand what threat model secure boot protects against
It helps if you remember the context in which Secure Boot was created. Back then, boot sector viruses and similar malware were common. The way they operated was by hooking the operating system while it was being loaded. The operating system (or software running on top of it, like anti-virus and other anti-malware stuff) could protect itself against something which loaded after the kernel and device drivers, but not against something which loaded before the operating system kernel itself.
That is: the main threat model Secure Boot protects against is boot sector viruses and similar. Even if some malware gets write access to the full raw disk, it still cannot inject itself before the kernel in the startup sequence.
> t helps if you remember the context in which Secure Boot was created. Back then, boot sector viruses and similar malware were common.
At the time the Secure Boot was conceived, boot sector viruses were extinct by about a decade. What was new, was the VM* set of instructions, and the scare that there could be a new kind of boot sector viruses slash hypervisors, which could do a bad things to your computer. There was never such a virus in reality, only hypothesized.
It helps if you remember the context in which Secure Boot was created. Back then, boot sector viruses and similar malware were common. The way they operated was by hooking the operating system while it was being loaded. The operating system (or software running on top of it, like anti-virus and other anti-malware stuff) could protect itself against something which loaded after the kernel and device drivers, but not against something which loaded before the operating system kernel itself.
That is: the main threat model Secure Boot protects against is boot sector viruses and similar. Even if some malware gets write access to the full raw disk, it still cannot inject itself before the kernel in the startup sequence.