Yes, a device which has been accessed physically shouldn't be trusted anymore (theoretically) but I was talking about the case of a booted device being stolen b

Yes, a device which has been accessed physically shouldn't be trusted anymore (theoretically) but I was talking about the case of a booted device being stolen by an attacker, not the case of one having been returned. In practice, If you can detect intrusion and the device has a secure boot system, wipe the device and issue it new keys, re-encrypt all data to the new keys with some backup cold-stored keys.