That Ubuntu "let's make GRUB more secure by forcing a ton of use cases onto an unsecure path" is some specious BS.
https://www.phoronix.com/news/Ubuntu-26.10-Lighter-GRUB
Ubuntu developers at Canonical are looking to strip the signed GRUB bootloader features to the bare minimum for the Ubuntu 26.10 release later this year