Ubuntu is QA (Quality Assurance) tested and works in
- legacy (CSM) mode,
- uEFI and
- Secure-boot uEFI
as do all Ubuntu flavors.
NO not all non-Ubuntu systems will work with Secure-Boot enabled as they have to arrange/purchase keys (they can provide their own keys that you can enroll/load into your firmware too & approve), though many of course will work.
Ubuntu Server has five years of supported life; thus if a key is revoked during those five years; new media is supplied; however Ubuntu's flavors only come with three years, so if a key is revoked in years 4-5 (as has happened before in recent LTS years) you won't have non-revoked media to install or re-install a flavor. For example keys for 20.04 were revoked causing new media to be created for Ubuntu required for Secure-Boot
The Ubuntu team is pleased to announce the release of Ubuntu 20.04.6 LTS (Long-Term Support) for its Desktop and Server products.
Unlike previous point releases, 20.04.6 is a refresh of the amd64 installer media after recent key revocations, re-enabling their usage on Secure Boot enabled systems.
https://fridge.ubuntu.com/2023/03/23/ubuntu-20-04-6-lts-released/
HOWEVER not even Ubuntu flavors provided new media; as the key revocation occurred after the three years of support had ended. You'll note there is no reference to flavors in the announcement link I quote & provided, thus Ubuntu flavors of 20.04 won't boot [ISOs] OR install with Secure-Boot enabled anymore.