UEFI legacy is not allowed with secure boot on. 

UEFI Class 3 bios removes CSM (Legacy) completely as an option.

Class 3 UEFI bios does not have any CSM and therefore there are no settings.

Class 3 UEFI bios is 64 bit windows 8 secure boot only forever.  No legacy, No CSM, No windows 7.

Its Microsoft Bios Jail and probably a violation of DMCA to break this "security" feature.  If you have a Class 2.3.1 bios then there would be some "settings" as far as Legacy and CSM but MBR/DOS/Syslinux is long gone.

Compatibility Support Module

The CSM provides additional functionality to UEFI. This additional functionality permits the loading of a traditional OS or the use of a traditional OpROM. This new functionality requires the following:

• New 32-bit code that operates in the EFI environment (EfiCompatibility)
• A stripped-down traditional 16-bit real-mode BIOS (Compatibility16)
• Code to transition between the 32-bit and 16-bit code (thunk and reverse thunk)
• Optionally code in SMM (CompatibilitySmm) to perform traditional functions not taken over by UEFI SMM.

SpeedStep,

Secure Boot is not enabled in this case and Legacy Option ROMs are enabled. The fact that UEFI PXE boot existed in previous versions of the BIOS but not in A16 is a regression. The information you provide is very informative but not exactly relevant to the OptiPlex 9010 BIOS issue introduced in BIOS rev A16.

A18 notes:

Once a machine has a Win8 Released BIOS running on it, downgrading to a Pre-Win8 Released BIOS requires removing some unique functionality and security enhancements that are only present in a Win8 Released BIOS. This downgrade process described here is specific to Win8 Released BIOS to Pre-Win8 Released BIOS transitions ONLY, and does not affect the normal rules/operations for downgrades of Pre-Win8 Released BIOS to an older Pre-Win8 Released BIOS, or Win8 Released BIOS to an older Win8 Released BIOS.

To install a Pre-Win8 Released BIOS on a machine running a Win8 Released BIOS, you will still use the same EXE application released for the BIOS version you wish to go to. When in Windows or DOS, your interaction with the application will be the same, but upon the machine restarting in order to do the update you will be prompted to accept the actions required in order to downgrade the machine and then prompted enter your admin password (if set). These prompts can not be accepted remotely and must be accepted by using an attached or built-in keyboard.

Due to compatibility of features, and ensuring platform stability, the only way to downgrade is to reset all the settings in the machine to a default factory state as if it had been shipped with a Pre-Win8 Released BIOS; specifically including defaulting the boot mode to Legacy (not UEFI), removing all passwords, and defaulting all user selectable settings. The following is retained on the machine (all other settings are reset): Windows Keys (if present), Service Tag, Asset Tag, Ownership Tag, Manufacturing Date, Ownership Date, and Express Service Code.

Downgrading is blocked if either Secure Boot is on or if Computrace has been activated. Due to security rules and protecting our machines from malicious attacks, if a user wishes to downgrade he/she must first ensure both of these are disabled or off. (Machines that are shipped out of the factory with Win8 Operating System are required to have Secure Boot initially on.)

After running the application, accepting the downgrading conditions prompts after restart, and the BIOS downgrading process is finished, the platform will be operating with the Pre-Win8 Released BIOS you desired. You may then go to the Firmware Setup to change settings and configure the machine as needed.

Quickly Identifying if You Have a Win8 Released BIOS Installed:
To quickly tell if a machine has a Win8 ReleasedBIOS on it, check if the boot screen does not display the model name and BIOS version under the logo. This information, model name and BIOS version, are now found in the F12 menu on a Win8 BIOS.