When it first shipped out, Secure Boot was used to lock other OSes out on early devices, it was after pushback that it was implemented such that it allowed you to enroll your own keys.

That said, there are countless mobile devices with locked bootloaders and and boot integrity attestation that will never run anything other than OEM OSes. That's equivalent to a locked Secure Boot + UKI-like system on PCs and it's already here.