One of the big goals of malware design is persistence -- the ability to hide undetected and resist all attempts at removal. Or put another way, making sure that once a device is infected, it stays that way. One of the best ways to achieve that is with a so-called root kit, which loads portions of malware before the operating system [OS], thus altering the way the OS behaves or performs. An early example was telling Windows not to recognize specific malware files, so as far as Windows was concerned, those files did not exist.
It's been possible for a while now to infect the bios, but only very recently has malware been found using this technique. Worse, it's been tied to the same Russian group that's previously caused havoc with destructive malware that spread [intentionally or not] far beyond the intended target. [While most malware is used to steal something, destructive malware wants to damage stuff, e.g. wiping disks.]
The Bios holds the firmware that makes things happen when you turn on a device -- it literally transforms a collection of electronic components into something like a working PC. Most somewhat recent PCs, laptops etc. use UEFI bios, meaning that the bios itself runs a minimal version of Linux or similar OS. And like any OS, it can be reprogrammed, infected with malware, which from a cybercriminal's perspective is a sort of Holy Grail -- infect the bios and the drives and OS become irrelevant... Replace them, reinstall them, nothing really matters. Once that happens, the only cure is to wipe the bios, and write a known good copy to it. One problem is that that's a bit risky -- anything goes wrong [stuff happens] and the device is often toast. Another problem is getting your hands on that known good copy of the bios code.
Secure boot, when it's available as an option in the bios, looks for signatures in the code that's run when you turn on [boot] a device. And it's often off by default, e.g. my wife's Lenovo 2-in1 came that way new. Whether or not it'll protect from every exploit is unknown, but it will protect against the exploit that's now being used because that exploit uses unsigned code.
Getting into the bios settings, and changing secure boot settings [e.g. turning it on] vary by manufacturer & model, so check the documentation from the manufacturer and follow their directions.
