yeah if some bad actor has physical access to your machine you can pretty much consider yourself screwed.