Please forget everything you ever knew about boot loader installation, at least with respect to the computer under discussion. You're trying to apply BIOS assumptions to an EFI (non-BIOS) computer, and they don't apply. (Yes, I know that most people, and even manufacturers, refer to EFIs as BIOSes, but that just causes confusion. See Adam Williamson's blog post on this subject for more details.) The Windows
bootrec /fixmbr command is intended for dealing with BIOS-mode booting, and so is inapplicable to you. I don't know about
bootrec /fixboot; it might or might not be useful on an EFI-based computer.
Under EFI, all boot loaders and related programs reside in the EFI System Partition (ESP), which is a FAT partition whose purpose is to hold boot loaders and related files. Ordinarily, a computer will have just one ESP, although it is legal for a computer to have multiple ESPs. A two-disk computer might have one, two, three, or more ESPs. In the case of a multi-ESP computer, it's unclear which one the Ubuntu installer will use. In theory, the Ubuntu installer should use the one identified as the "EFI boot partition" (their own non-standard name for the ESP) in the installer; however, I have my doubts about whether Ubuntu does this consistently. (I haven't had the chance to look at this in depth.) In any event, the Ubuntu installer retains a BIOS-mode prompt for where to install the boot loader when installing in EFI mode, but it's completely useless! I think there's a bug report about that on Launchpad, but a quick search didn't turn it up.
In theory, then, an EFI-based computer can have dozens of boot loaders installed. Which one does the firmware actually use? This is determined by a set of NVRAM entries, which identify the boot loaders and list the order in which they should be tried. The NVRAM entries identify boot loaders by partition and filename.
It's unclear whether you've got one, two, or more ESPs; however, because the NVRAM entries identify boot loaders by partition and filename, that detail is essentially irrelevant. Chances are that what happened is that Ubuntu added GRUB to an ESP and added an entry to the computer's NVRAM telling it to use GRUB by default. (In fact, it would point to Shim, which is one of Linux's tools for dealing with Secure Boot. Shim will then launch GRUB.) I'm not sure why you're getting a Secure Boot warning followed by GRUB. Maybe you've got an NVRAM entry that points directly to GRUB without going through Shim followed by an entry that points to Shim. That would explain it, but AFAIK the Ubuntu installer doesn't set things up this way.
Under EFI, you can edit the NVRAM entries to control the boot order. In Linux, the
efibootmgr utility does this job. In Windows, you can use
bcdedit or a third-party tool like EasyUEFI. Using
efibootmgr, type the command alone to see a list of boot entries, then use the
-o option to set the boot order, as in
efibootmgr -o 5,3,8 to have the firmware try
Boot0005 first, then to launch
Boot0003 if that fails, and finally to try
Boot0008. (Of course, you'll need to set the order for your system, based on the output of
efibootmgr without any options.) Most EFIs have their own boot manager to enable you to select a boot loader. Details vary greatly from one computer to another, though. You must typically press a function key early in the boot process to get to this boot manager.