I don't have a TC56 to do any test.  However, based on tests on many other devices of other brands, the following may be worth noting.  The behaviour may differ for different brands or Android versions.

If your device has Password rather than 4-digit PIN, then using "resetpassword  XXXXXX' will change the password without changing the secure startup configuration (i.e. whether device boot-up also requires the password).   If you use 4-digit PIN on your device, "resetpassword ####"  will modify the PIN as well as change the secure startup mode. 

Do either of you by chance have any further information about secure start-up. I'd like to prevent the end user from being able to set secure start-up all together. 

We have TC75x devices enrolled in AE using MobiControl. They are currently on Android 7.1 but we are testing a move to Android 8.

Basically, we would still like to have the end user set their own screen lock PIN code. We can reset that easy enough using MobiControl. However, if they enable secure start-up and reboot, we have no control over resetting the PIN code. We have had a few instances of employee turnover or an employee forgetting their PIN and we are unable to unlock the device because it is waiting for the secure start-up PIN.

Any setting through MobiControl or StageNow that might disable secure start-up?

This is the behaviour i witnessed with Zebra devices.

If the device has a PIN code prior to using that script it remains as it should no secure boot pin.

If you use an authentication profile and allow user to enter PIN it automatically sets the boot pin aswell.