With enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.
And that is what Secure Boot does for you. Not the TPM.
And to do that, a TPM is needed to keep the keys/signatures