SUSE and Secure Boot: The Details (SUSE Blog)

The malware can just put something in the "StartUp" folder or similar that exploits the kernel and then does whatever it would have done if it has infected the boot sector, including blocking or filtering updates to the OS and all security software, putting the OS in a VM, etc.

Secure boot is mostly useless unless the signed bootloaders and kernel either don't allow arbitrary applications to run outside a truly secure sandbox, or at least download and execute an update from the Internet before running such code (the update would include malware removal code, obviously).

The former would require a complete redesign of both Windows and Linux, while latter is still very tricky (you must use trusted drivers, and you can't use normal network configuration, or malware would simply configure a bogus static IP address, making the update fail, and then fix it later when it owns the machine).