What I do is seal the disk encryption key against PCR 7 (among others) so even if it secure boots up, unless it boots with grub verified with a specific key, it won’t be able to decrypt the disk.
Not a huge problem if you keep your recovery key ready when doing firmware updates (which you probably should be doing anyway) so you can re-enroll the key afterwards, but I believe this is the reason default configurations tend not to include PCR 7.
But indeed: the article describes secure boot working as intended and PCR 7 is one of the ways you prevent providing access to a drive in these circumstances.