That is actually the case. Point 17 states:

    Mandatory. On non-ARM systems, the platform MUST implement 
    the ability for a physically present user to select
    between two Secure Boot modes in firmware setup: "Custom"
    and "Standard".