Aside from the fact that this is obviously not true (secure boot is possible on Linux, limine/lanzaboote come to mind), I would argue these security modules / attestations do very little for security and are more about lock in and control.

Look, if Canonical had one of their keys leaked, I can go and sign my kernel and kernel modules and secure boot just fine as if my kernel is one distributed by Canonical. There are no checks on whether the contents of the kernel are correct. So, let's exclude people entirely from tuning their kernel for performance etc, and tell them they have to go to a narrow set of approved vendors, who must listen to Epic rather than their users. This is about control over the ecosystem, an ecosystem Epic has spent their years spitting in the face of.

Yes, but that alone doesn't prevent the cheats, because you get developer access.