Most browsers store passwords unencrypted. A basic rule of security is that physical access means all bets are off. Only disk encryption will save you against physical access.
yeah if some bad actor has physical access to your machine you can pretty much consider yourself screwed.