I think you are missing the step where the machine is up and running when you boot SCCM's WinPE, and you are making changes to the BIOS and imaging 'after' changing the BIOS settings... Those BIOS settings would require a reboot to take effect
So, make the changes with BCU to reflect your need to enable SecureBoot and Boot order configuration. Reboot, and go back to pxe loading your WinPE to continue your task
