I found the concept of Secure Boot quite intriguing. I can't say that I know much about it because I don't but I believe I understand the main concept of it.
Secure Boot verifies the signature of the executable the computer is booting. (Usually, the case is the bootloader)
On a computer without secure boot, an attacker could just overwrite
\EFI\Boot\bootia32.efi depending on the architecture with his own program, his program would somehow infect the machine OS and continue execution with Windows's bootloader which is stored in
Secure Boot prevents that because the attacker's EFI executable isn't signed.
But that could easily be evaded.
An attacker could just install
systemd-boot bootloader which would call the attacker's EFI file which would call the Windows Bootloader after it does its work.
Am I missing something?