SUSE and Secure Boot: The Details (SUSE Blog)

A BIOS booting a CD is not guaranteed to give you a secure system as there is nothing protecting the BIOS itself. The BIOS can be modified with malware that you'd be unable to detect with anything running afterwards. UEFI Secure Boot both protects the firmware from modifications unauthorized by the user and provides a base to check the bootloader, kernel, etc. so that you can have a small beachhead of known good code before any malware can load. This allows you to self-host the kind of rootkit scanning that you are trying to use a CD for.