Experimenting the other day, updating WinPE to see if it would boot with the new secure boot mods enabled -- it would not, at least with my VM -- I came across something to try with the bootable USB sticks you can create with AOMEI Partition Assistant & Backupper. They've been broken it seems like forever, refusing to boot when secure boot is enabled, and it turned out, a simple file replacement worked! I'd guess it might work with EaseUS USB sticks too, but I no longer have any EaseUS apps to try it with -- it might also work with several other brands of software that can't produce a secure boot compatible bootable USB stick.
The fix is to go to the Windows\ Boot\ EFI\ folder & copy the bootmgfw.efi file, rename it bootx64.efi, and replace the file with the same name on the USB stick -- for a USB stick created in AOMEI Partition Assistant, that file is located in the EFI\ BOOT\ folder. When Partition Assistant created the USB stick it copied / used a few other, related files from the same EFI folder, but for some reason skipped that one, possibly because it needs to be renamed(?).