Let’s assume it’s deactivated, would that be a negative thing security-wise?

“Secure Boot” is one of those doublethink names that doesn’t mean what what one would assume. As originally designed, it was more about keeping “Designed for Windows 8” computers “secure” on Microsoft’s behalf against their owners by preventing alternate OSs like Linux from being installed than it was for doing anything for the device owner’s benefit. In other words, it’s a locked bootloader that prevents jailbreaking.

Obviously there was a lot of pushback (and continued to be with each new Windows release) and the nightmare scenario of locking Linux out of running on new desktop PC hardware hasn’t come to pass (yet), but the normal way that Linux distros achieve “compatibility” with Secure Boot is by including a “shim” bootloader signed by Microsoft. In other words, normal desktop Linux depends on Microsoft’s goodwill to be “allowed” to run.

Although I believe it’s possible for a Linux user to use Secure Boot for their own benefit by generating and signing their own encryption keys instead of using the “shim,” I think it’s something that only the most paranoid folks actually do.

Also, somebody’s gonna say it so it might as well be me: the foolproof way of preventing Windows from breaking your Linux install is to quit booting into Windows, and to start using e.g. LibreOffice instead of MS Word to write your school documents.