From
https://support.apple.com/guide/security/startup-security-utility-secc7b34e5b5/web
Full Security boot policy
Full Security is the default boot policy, and it behaves similar to iOS and iPadOS or Full Security on a Mac with Apple silicon. At the time that software is downloaded and prepared to install, it is personalized with a signature that includes the
Exclusive Chip Identification (ECID)—a unique ID specific to the T2 chip in this case—as part of the signing request. The signature given back by the signing server is then unique and usable only by that particular T2 chip. When the Full Security policy is in effect, the
UEFI firmware ensures that a given signature isn’t just signed by Apple but is signed for this specific Mac, essentially tying that version of macOS to that Mac. This helps prevent rollback attacks as described for Full Security on a Mac with Apple silicon.
From the line you posted:
"This ingenious new boot process does have consequences, though. Failure of internal storage means failure of the whole Mac, which can’t then boot from an external disk, which lacks the essential iSC and can’t provide 1TR either. I think this is already true for Macs with T2 chips, with their single security policy, rather than one for each bootable operating system as in the M1. I suspect it’s also, in part at least, responsible for the lack of an Internet Recovery Mode in M1 Macs."
They appear to have taken things further with the M1 Macs but they appear to have already been heading down this road with the T2.
The site you posted a link to has an article on the three types of Mac and the differences in how they boot:
Before Apple added T2 chips to Intel Macs, external boot disks were valuable for many users. How has that fared since?
eclecticlight.co
"As far as external bootable disks are concerned, M1 Macs are more permissive than Intel models with a T2 chip, but what they permit is more restricted: there can be nothing equivalent to Boot Camp, for example."