That's because current generation of hardware does not mandate secure boot on x86. I expect that will change once Windows 11 has had a few years to turn the majority of the computers secure-boot capable due to its hardware demands.

That would be against the current UEFI spec. I get that people are cynical and expect this to happen but I don't think it will.

There are however going to be a lot more issues self-enrolling keys going forward.

Just for clarification, I believe you mean that it's not something supported out of the box, in the form of a signed kernel / bootloader. It is something Arch Linux users could choose to set up themselves; there's a whole wiki article on it.