It wouldn't be impossible to change the default kernel commandline in the image without recompiling the whole kernel if anyone cared about making that fast.
I mean, even the initramfs can be stored in the ESP, can't it? How's that work with Secure Boot? (assuming you don't just use a shim that makes the TPM happy and then proceeds to not actually verify anything afterwards.)
