• Do not use WindowsUEFICA2023Capable for determining anything
• UEFICA2023Status will track boot manager as well as  DB and KEK contents. It will not track SVN and 2011 certificate revocation in DBX, nor does it track SBAT status. Those are triggered by AvailableUpdate flags 0x200, 0x80 and 0x400, and they are not included in the suggested AvailableUpdates flags, as they are not required to keep all components of Secure Boot servicable by Microsoft. They are recommended to harden against certain targeted attacks, but if you go that route be aware that you may need to recreate all boot media created before July 2025 as well as all that still contain the 2011 signed bootloader or they won't boot without disabling Secure Boot
• There are two bootmgfw.efi in Windows directory, one in C:\Windows\Boot\EFI and one in C:\Windows\Boot\EFI_EX. They are expected to be 2011-signed and 2023-signed, respectively, and are no indication which one got installed to your ESP
• I am not aware of a broken Get-SecureBootSVN cmdlet. To check the SVN manually (for bootmgfw.efi) you can run this:

Get-SecureBootUEFI dbx -decoded | Where-Object {$_.Hash.StartsWith("01612B139DD5598843AB1C185C3CB2EB92") }

The resulting hash will, after the shown prefix, have a bunch of zeros, then the SVN as a hex digit, then another bunch of zeros. If no hash is shown, no SVN is recorded and the SVN is therefore 0.

For the "WindowsUEFICA2023Capable" key, the documentation says "For reference only - do not use this key when getting status on Secure Boot updates. Use the UEFICA2023Status key instead"

For the signed boot manager, I wouldn't use Get-AuthenticodeSignature as you'll get mixed results - it may not choose the correct certificate. To more accurately check for the signing cert, I use the following PS code. You can simplify this by using mountvol if you prefer.

In my environment, using this along with the db cert checks this has returned a more accurate picture of the update status than any current reporting mechanism from MS including the UEFICA2023Status key and the Intune report.

# Check whether the boot manager has been updated with the new cert
$SystemDisk = Get-Disk | Where-Object IsSystem
if ($SystemDisk)
{
    $SystemPartition = Get-Partition -DiskNumber $SystemDisk.DiskNumber -ErrorAction SilentlyContinue | Where-Object IsSystem
    if ($SystemPartition)
    {
        $params = @{
            DiskNumber = $($SystemPartition.DiskNumber)
            PartitionNumber = $($SystemPartition.PartitionNumber)
            AccessPath = 'S:'
        }
        Add-PartitionAccessPath @params -ErrorAction SilentlyContinue
        $SystemPartition = Get-Partition -DiskNumber $SystemDisk.DiskNumber -ErrorAction SilentlyContinue | Where-Object IsSystem
        if ($SystemPartition.AccessPaths -contains 'S:\') 
        {
            $bootmgrPath = Join-Path 'S:\' 'EFI\Microsoft\Boot\bootmgfw.efi'
            if (Test-Path $bootmgrPath)
            {
                try 
                {
                    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromSignedFile($bootmgrPath)  
                }
                catch { }
                if ($null -ne $cert) 
                {
                    $issuerName = $cert.Issuer
                    $commonName = $issuerName.Split(',')[0].TrimStart('CN=')
                    $dateString = $cert.GetExpirationDateString()
                    $notAfter = $dateString | Get-Date -Format "yyyy-MM-dd HH:mm:ss"
                    $expiresInDays = ((Get-Date $dateString) - (Get-Date)).Days
                }
            }
            Remove-PartitionAccessPath @params -ErrorAction SilentlyContinue
        }
    }
}