It prevents rootkit malware that loads before the OS and therefore is very difficult to detect. If enabled, it tells your machine to only load the OS if it’s signed by a trusted key and hasn’t been tampered with.