What I do is seal the disk encryption key against PCR 7 (among others) so even if it secure boots up, unless it boots with grub verified with a specific key, it won’t be able to decrypt the disk.

PCR 7 tends to get changed with firmware updates, for example when Microsoft rotated its secure boot certificate (which is still a work in progress, depending on if you've installed a certain Windows Update or not).

Not a huge problem if you keep your recovery key ready when doing firmware updates (which you probably should be doing anyway) so you can re-enroll the key afterwards, but I believe this is the reason default configurations tend not to include PCR 7.

But indeed: the article describes secure boot working as intended and PCR 7 is one of the ways you prevent providing access to a drive in these circumstances.

You at least have a PIN on top of thatm right? Right?