No, that is incorrect.
Using the Windows OEM signed certs only means that you can install the KEK without enabling Setup Mode, since, outside of Setup Mode, you must use signed packages to update the Secure Boot databases. But the end result will be EXACTLY THE SAME, as the signed "wrapper" is...