Generally speaking, if you have physical access to device, all bets are off. Which when you think about it is the point of the whole article.
"Secure against physical access by all but extremely determined attackers" is worth aiming for. Even if it's just a measure against the resale of stolen devices.