It's not true, certainly can restrict the installing of certain apps which need admin privilegs, but it's a malware scan beginning with the boot sector, avoiding root kit malware.

Secure Boot requires uefi payloads to be digitally signed, Microsoft holds the signing keys.