PCR 7 tends to get changed with firmware updates, for example when Microsoft rotated its secure boot certificate (which is still a work in progress, depending on if you've installed a certain Windows Update or not).

Not a huge problem if you keep your recovery key ready when doing firmware updates (which you probably should be doing anyway) so you can re-enroll the key afterwards, but I believe this is the reason default configurations tend not to include PCR 7.

But indeed: the article describes secure boot working as intended and PCR 7 is one of the ways you prevent providing access to a drive in these circumstances.