Really Linux distros just didn’t work with it right out of the box...

From what I've read, this is misleading. Default secureboot within Windows will only boot a bootloader signed with Microsoft's key. Although Microsoft does seem to provide a signing service for signing with their keys, this is at their mercy. Windows made a change that broke booting alternative operating systems unless they use a service that Windows provides to fix it, or disable secureboot.

The “I hate change.” Mindset.

Or maybe it's extra complexity that often leads to the first recommendation to fixing Linux not booting being "disable secureboot" and how this is an extra hurdle to jump through for new users. As well as increased likelihood of problems, due to secureboot.

So is it considered 'secure'? and to what extent?