Wouldn't that require that the complete boot chain is totally locked down and cryptographically secure?

If you can insert a usb-plug and boot from that you could unlock the disk with the help of the tpm, or interrupt grub and set init=/bin/bash.

Or since the scenario is that the attacker have physical access, maybe desolder the tpm chip and move it to another computer where they have control over how the machine boots.

I guess modern gaming consoles are locked down in such a way so that this makes sense, but I have never seen a general purpose computer secured like this.

Thanks for explaining, I guess the above was mostly my stream of consciousness ranting.