Still, unprotected accounts seem like a pretty insecure idea to me. That's how our "attacker" got themselves in.

Of course in a free world physical access to a device you own would mean that you can modify its behavior ("hack" the software).