This was always intended. If you don't want Microsoft keys sitting at the root of the trust chain, you can also enroll your own keys (with UEFI access). And Microsoft literally forced vendors to allow this by making it a requirement to be able to call a device Windows-ready or whatever it's called. Yes: MSFT explicitly wanted it to be possible to remove MSFT keys from your device.

There's many things that Microsoft deserves a lot of criticism for, but Secure Boot is not one of those things in my eyes.