They’re not wrong. This is the code signing of your bootloader, kernel, etc that would prevent for example someone tampering with your boot partition to silently capture your encryption password the next time you type it in at boot. It’s a real threat but not one I’m concerned about. I have no idea if Pop OS not doing this is a regression from upstream Ubuntu or not.