Secure for software and content vendors, not necessarily for the users.

How many trashed Windows 10 PC's are home desktops or laptops used without a password in the first place? But grandma's PC needs secure boot against Tom Clancy level threat actors, it's for her own good.

TPM enables VBS, so yes it does provide significantly increased security.

I have a modern CPU / motherboard (made in the last 4 years) that I spent $2000+ on that doesn't have TPM 2.0. Guess I'm never upgrading to 11.

You might have an option to enable it in BIOS that's turned off by default, that was the case for my desktop PC.