Rollout model clarification (Telemetry vs. Policy)

We observe that a significant number of devices already show “Certificate Status = Up to date” in the Intune Secure Boot Status Report, even though our Intune Secure Boot policies are currently still failing with the described error 65000.

Given this, we would appreciate clarification on the following:

Does Microsoft currently deploy the Secure Boot 2023 certificates using a hybrid rollout model (telemetry-based CFR combined with optional policy-based control)?

At what point will policy-based opt-in become the primary or required mechanism for IT-managed devices?

Will devices without an effective policy continue to receive the certificate updates automatically via telemetry-based rollout until Secure Boot enforcement begins in 2026?