Setting PERMISSION_SECURITY to ‘secure’ configures polkit to requires users administrative rights to power off and reboot the system, but it still allows them to do so from the login screen.
Is it possible to deny users from rebooting or shutting down the system from the login screen too (sddm)?
You could try what sddm.conf according to the man page allows:
[General] section:
HaltCommand=
Halt command. Default value is "/bin/systemctl poweroff".
RebootCommand=
Reboot command. Default value is "/bin/systemctl reboot".
Perhaps change them to false and/or something else. Although people reported in that thread that even that doesn’t work.