I have a sneaking suspicion that these PCs will have some sort of protection so that nothing other than Win365 can run. Maybe a locked bootloader/secureboot?

Yes. Very probably.

Of course, no security mechanism lasts indefinitely in the hands of a persistent hacker with physical access.