If the end user can arbitrarily sign code themselves that is bootable then it kind of defeats the purpose of secure boot.

They can & it doesn’t. They can change the platform key to become the platform owner & control the public keys they keep in the code signing databases. Secure Boot gives the platform owner control over authorized code signers of boot processes.