It has very minimal code and its implemented in a robust manner. Unlike UEFI and the desktop implementation of secure boot, it does work well and it has not yet been exploited on pixels. Its way better to have any kind of OS integrity check than none.
This is unrelated. You want to familiarize yourself with the concept of OS integrity and how it is different from data encryption. You can have a passphrase that encrypts your data alongside having access to these hardware features.