They could ban and phase out systems with unsecure bootloaders. That would go a long way. Many vendors have already locked down their boot process.