It's also for DRM purposes, I'd imagine. Rooted Android tablets (and to a lesser extent, rooted iPads) are considered a major problem by many software developers. Microsoft said, "no worries, bro, we gots your back." Rooting the Surface -- and hence bypassing the DRM -- is not going to be easy, and hence application developers on Windows 8 RT can rely on their users being legitimate paying customers. Same goes for any media DRM.
The other part is protecting these simplified devices from certain classes of malware, which does exist in the wild for rooted iPad and Android devices, I might note. The people who want SecureBoot to outright disappear are absolutely retarded. Demanding that you have some means to control it if you own the device is very reasonable, but asking that the world do without legitimate security protections entirely because you're afraid some hardware vendors will be mean is silly.