If Secure Boot is not enabled, Windows can continue to boot and install regular OS updates. However, the device won't receive future Secure Boot/boot-chain protections until the updated 2023 certificates are applied. Turning Secure Boot on later without those certificates may lead to boot issues once newer, 2023‑signed boot components are in place. The safest path is to turn on Secure boot and apply the 2023 certificates now.