It just needs a few minor hoops to sign the boot loader - steps that would be difficult to social engineer around but perfectly reasonable to do them intentionally if installing an alternate operating system is your thing.
Does that not create a barrier for entry for non-technical people looking to use an alternative operating system?