Having DFU in BootROM is good. Having "secure boot" with only the vendor keys in BootROM is evil.