That's kind of the thing with Microsoft's bitlocker as well. It automatically decrypts the hard drive on boot, so the only thing it could protect you from is someone removing the hard drive and mounting it somewhere else. But if they have physical access to the device, why would they do that?

I think the idea is that Windows' security, once booted, is enough to protect your data. It's the same situation if, for example, your laptop gets stolen while in sleep / on the lock screen.

In theory, you shouldn't be able to get the key while booting on some other media (say, your own Windows USB drive).

> Ensuring the integrity of early boot components and boot configuration data. On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer’s BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that leverage TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability.

https://docs.microsoft.com/en-us/windows/security/informatio...

That's the default configuration for bitlocker, but there are others, including requiring a password or key provided by USB on startup

Physical access does not imply easy arbitrary code execution.

Consoles are largely protected by the same technology, how often do you see people achieving code execution on them by tampering with the hardware?

All the time? Hardmods have been a thing since the first consoles, all the way down to the latest Nintendo Switch.

Also, consoles are "protecting" not the user, but the manufacturer - which is exactly the point people are trying to make.