Pretty sure it’s always been like that. You technically can enable secure boot, but to my understanding updates will force you to set up custom keys again, and I’m fairly sure Nvidia refuses to release drivers that can be signed.

burakberk.dev/complete-guide-enabling-secure-boot…