How quickly certs went from "securing your software" to "securing our business model".

It was never about security. '"Secure" boot' is older than this and was the same trick, they would ideally not allow you to boot anything that wasn't signed by them. It is already very frustrating that you have to go out of your way to enter the UEFI and disable it. For everyone but the technical user, their goal is already accomplished.