evil maid attack wouldn't have worked in this situation, since she broke in and stole the laptop. I also doubt she has the know-how to perform an evil maid attack. Enabling a BIOS boot password would make it more difficult to stealthily perform an evil maid attack. Finally, "no security is perfect" is not an excuse for having no security.