Qubes OS does support UEFI (so legacy boot shouldn’t be needed anymore as far as I understand).
Secure boot does require some signing keys to be available in order to verify the OS that is being booted. Unlike keys that are shipped with your laptop by some OEMs, the keys that would be needed to verify a Qubes OS instance are not available, so secure boot will prevent Qubes OS from booting.
Related (including pointers to alternatives to secure boot):