The only thing then that would be needed (IMHO) is then that if something errors out/goes wrong due to lockdown being enabled is that it must be clear (in the kernel log probably although a return code might work as well) that it is lockdown that is preventing some action from occuring. Otherwise I expect that a lof of issues in programs might be hard to 'fix'[1] since people might chase down the wrong path.

[1] Note in that case closing the bug report with 'won't fix' with a messafe of 'please disable secure boot/kernel lockdown' would be a "fix" depending on the goel of the progam of course