Secure Boot Report is Back - But What is "Unknown"?

So as I start to map out the requirements and plan for the cert updates this year, I noticed the other day that the Secure Boot Report has resurfaced! But what is Secure Boot enabled = Unknown mean and enumerated? Around our clients we do have the odd page or two per client I have one client with seemingly 1000+ PCs in this state and did think because they don't have E3 minimum that the report just won't work, much in the same way the Detection script requires licence attetestion enabled.