Being open source doesn’t uphold a lot of standards of privacy and security for VPNs. It’s not useless, but the most common worry about VPNs is traffic logging, and open source apps do nothing to prevent this since it’s server side. ProtonVPN and Mullvad VPN don’t protect from themselves, and they can keep logs. The reason they’re commonly recommended is that they’re more trusted in the privacy community in general. Obscura VPN and Nym VPN do mostly protect from themselves because they’re a two-hop VPN. In the case of Obscura VPN, it’s a first hop through their servers, and a second hop through Mullvad’s. So to associate your traffic with your IP address, Obscura and Mullvad would need to cooperate, which is quite a bit less likely than a single VPN operator logging user traffic.

That’s only one use of secure boot. It’s also supposed to prevent UEFI level rootkits, which is a much more important feature for most people.