Tech Challenge

A laptop boots with UEFI Secure Boot enabled, as shown. Malware that already has Administrator privileges tries to install a bootkit by replacing the bootloader, and the machine refuses to boot it. What does Secure Boot actually enforce, and what does it NOT protect against?

$ mokutil --sb-state
SecureBoot enabled

$ bootctl status | head -4
System:
     Firmware: UEFI 2.70
  Secure Boot: enabled (user)
 TPM2 Support: yes