Your GRUB can be encrypted behind FDE and iirc there is also an option to create a password for grub. So far I haven’t seen cases of bootloaders being compromised/bypassed so we are not there yet.
Pretty sure there’s not a lack of guides for setting up secure boot on Ubuntu/Debian, unless you are looking for something specific.