Based on your explanation I can only see that it restricts the owner of a device (usually he is the only root, otherwise you would have other things to worry than secure booting a machine anyway...). If this is done solely in the interest of security (of whom?) then there should be a way to disable vendor keys on a device that I own. I don't see how I should be able to trust UEFI secure booot either, it is just another binary blob that a user is forced to trust without open source.