Secure boot is enabling lockdown in confidentiality mode. Confidentiality mode is intended to prevent root from being able to extract any secret material contained within the kernel. Since the kernel doesn't flag secret material, this effectively means denying read access to all kernel internals that aren't explicitly exported to userland - this breaks various types of useful debug and analysis functionality.

Our boot process is not currently especially secure, so anyone who's in a position to get root access is also (realistically) in a position to intercept any secrets before they're injected into the kernel in the first place. Locking the kernel down to integrity mode, rather than confidentiality, makes sense.