I think you're selling Apple short on what they accomplished with Apple Silicon Mac boot security.
They managed to square the circle: although the computer supports and defaults to full boot security (all boot software components cryptographically signed and verified to come from Apple without tampering), the computer's owner can use recoveryOS to set up an unsigned OS. Unsigned OS containers exist side-by-side with fully secured containers, and cannot compromise them. To cap it all off, the way Apple implemented this permits others to implement their own fully secure boot chain on top of Apple's. This is because Apple never actually disables signature checking, but they do permit recoveryOS to enroll locally-generated signatures into the Secure Enclave for bootloaders the user says they're willing to trust. This means they can detect any subsequent alteration of that bootloader, even though it's not signed by Apple, and refuse to boot it until the user has redone the local signing process (meaning, boot into recoveryOS and go through the procedure for setting the most relaxed boot security mode on that OS container).
This is how Asahi Linux boots. They don't currently implement a secure boot chain (signature checking stops at the first stage Asahi bootloader), but plan to do it someday after implementing higher priority features. (This may have changed after Hector stepped down, don't know if the project's current leadership and members are as interested in secure boot as he was.)
The only downside to this system is that it's much less convenient to alter Mac boot settings than it used to be, as you can only manipulate Secure Enclave signatures and OS container security settings from inside recoveryOS. It's the price of Apple making it impossible for successful malware attacks against one OS container to compromise the security of other containers.
