that without full disk encryption or locking down your config, an attacker with physical access to your system can simply edit the boot parameters (adding an "s" for single user (root), or "init=/bin/bash")) and boot straight into a root shell.