Apple could keep Secure Boot, but allow other operating systems (i.e., Linux) to access the internal hard disk with it disabled. Better still, they could allow installation of custom certificates.

Keeping it updated and working with secure boot isn't the problem. The problem comes when the person/company/government holding the keys decides that they no longer want to sign your software, and the hardware doesn't allow you to add your own keys. Then "your" computer can only run the "approved" software, not the software that you, the owner of the hardware, want it to run. That's exactly what's going to happen with these new machines in 5-6 years, just like iPhones. Apple won't support installing the latest version on this "old" hardware, and therefore won't sign the OS to be able to boot into the "trusted" environment for it. Yes you could turn off the trusted environment and apply some hacks to get it to install just like "old" Apple machines right now, however since you're no longer running in the trusted environment the internal SSD won't be visible so you'll have to use external storage. I still have a few 10+ year old machines that work well enough to do anything I would normally do with a computer, though they are a bit heavier and use way more power than modern equivalents. They still can be used, and there's no reason to throw them out just because they're no longer supported by the original manufacturer.