Secure Boot tries to make sure that the device BIOS only starts / runs legitimate software, e.g. Windows boot loader. It's not foolproof, but with more malware targeting the BIOS, it may help. The hardware requirements for Windows 11 list "Secure Boot capable", and installing Win11 *may* attempt to turn it on, but like the CPU & TPM requirements, once Win11 is installed, the only time it actually checks is when you open Windows Update, where you may see a message that the device does not meet Win11 requirements. Otherwise Win11 works fine, so enabling Secure Boot is entirely up to you.
Unfortunately there's also a catch -- Secure Boot is turned on/off in the BIOS settings, but the BIOS showing it turned on doesn't mean much at all... I suggest running HWiNFO to make sure -- it's also a handy app in its own right, giving you all sorts of information, whether you need it or are just curious. neowin[.]net/news/hwinfo-716/
If Secure Boot is turned on in the BIOS but not actually enabled, sadly, there's not an easy cure... Google and you'll find that it's not an isolated complaint -- you'll also find reports of people getting it working by more or less blindly fiddling with related BIOS settings. In my case with a Gigabyte motherboard, in the Secure Boot settings I selected custom, restored the factory keys, then again selected standard, rebooting for each change, and it worked, but I've no idea if that would work for anyone else.
Background...
Most reasonably current PCs/laptops use what's called an UEFI BIOS -- it started to appear right about the time Win7 was 1st released [and Win7 didn't like it At All]. Before that the BIOS was hard coded individually for the device motherboard, which is now called Legacy BIOS. UEFI BIOS run a sort of mini version of a Linux-like OS, and because it is an OS, it can be [too easily] hacked, which is THE worst case scenario. When a device [computer] is turned on, the BIOS is the first component that's active. It determines what other components are connected, ties them together, and then starts the OS [operating system software]. Once malware's installed in the BIOS, it can direct the device to do whatever it wants, including running malware completely in memory so that it's pretty much undetectable. It's also hard, may in fact be impossible to remove... the BIOS cannot usually be replaced without replacing the main system board [motherboard], the code to re-flash the firmware is not always available, and re-flashing the BIOS can be risky, since it can brick that main board. It's also at least theoretically possible for an infected BIOS to prevent you from re-flashing it with its original code, e.g. it could prevent booting to a USB stick or optical drive to run the flashing software, &/or turn off the feature in the BIOS settings which allows flashing the BIOS.
