I know the Arch wiki documented some ThinkPad BIOS versions where trying to clear boot keys bricks the laptop motherboard so that is a pain in the butt. Be sure to check there isn't a good reason why the dbx install fails or aborts before trying too hard fixing something that probably isn't too much of a hindrance. I get it is annoying to see it in the software updater all the time and I would feel nicer about my machine not having long published security holes but I like it better to not brick it when I don't feel confident about undoing my tinkering.
Lenovo ThinkPad T14s (AMD) Gen 1 - ArchWiki as an example (the ThinkPad I ended up getting doesn't seem to have this problem but the dbx updates stall out all the same lol.) Also some models alow you to replace the firmware with Coreboot or Libreboot which can be a good way to un-screw-up secureboot. Be sure to check your specific motherboard/laptop model by searching everywhere online before touching secureboot when you are already booting into your desired OS.