After getting my hands on the P2 Max, I checked to make sure it has TPM 2.0 (using tpm.msc) and secure boot (by booting into BIOS to see that it is enabled), though I did not see any Intel virtualization setting in BIOS. I successfully upgraded to Windows 11 (final version, no beta) and it has been receiving updates. When I check “Windows Security” app, all options show OK (green check mark). When I open “Device Security” section, it shows “core isolation” and “security processor” but not “secure boot”, and it says “standard hardware security not supported”. However, BIOS shows secure boot is enabled. Do anyone find the same problem?
Problem solved - I notice fastboot was enabled in the BIOS. I disabled it and now Windows Security app shows secure boot option is supported.