With LUKS, your boot/efi partition is still unencrypted. So someone could install a malicious bootloader, and you probably wouldn’t know and would enter your password. With secure boot, the malicious bootloader won’t boot because it has no valid signature.