UEFI secure boot kernel restrictions

What treat does closing these "holes" fix that wouldn't also be holes in booting a "mal-Windows" under say qemu? The mal-Windows is still not able to change any of the secure boot UEFI parameters without user intervention is it? Maybe I am not inventive/imaginative enough, but it seems there is no difference between this and running any Windows (or other OS) version under "normal" emulation. Or is there?