With you mentioning secure boot and TPM, that makes me wonder how Microsoft might embed that hardware into their activation string and the TPM and secure boot keys could be a form of identifier? I wouldn't have expected that, since it is only recently that they were even required for Windows installs, but it does make me hesitant to mess with these features once they're enabled.
I've read that Microsoft uses the SMBIOS table as part of the "hardware" ID - and I think possibly that gets changed when you re-flash bios, or possibly the values described by that structure change when you update the bios and that's what kicks it off thinking you've changed the whole motherboard possibly?
I don't really know, it's all just bits and pieces I've read in threads.
When I went to flash the bios it did give me a warning to suspend bitlocker and anything else that relied on the TPM. When I first booted back into windows I had to make a new pin for windows hello (since that's in the TPM too). I've not noticed anything else I've had to re-enable or setup again though.