There was once a time while windows RT still existed and microsoft had a requirement that it must not be possible to disable secure boot. There is also the T2 chip on macbooks which currently does this.