Much ado about nothing.
An attacker needs at least physical access to the device. Wow, what a danger.
cf. "The 10 Immutable Laws Of Security"
"Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore."
https://uptakedigital.zendesk.com/hc/en-us/articles/115000412533-10-Immutable-Laws-Of-Security-Version-2-0
@[email protected]
"Google" - spot the original sin.