That is not the purpose of Secure Boot. The purpose is to establish a chain of trust of all code running on the system from boot and as such eliminate rootkits that can hide from the OS. A classic example is the MBR bootkit. Of course that this is mostly out of the window if at some point in the chain the trusted code just runs untrusted code, like the bootloader or the OS running unsigned code. Also the implementation is terrible, a proper implementation would allow the user to use their own certificates and only their own certificates, otherwise a compromised generic certificate fucks everything up like it already happened.