The only thing TPM based disk encryption protects is the kernel and the login screen. Without disk encryption somebody could modify your kernel or boot sequence

The only thing TPM based disk encryption protects is the kernel and the login screen. Without disk encryption somebody could modify your kernel or boot sequence and inject something nasty. Likewise they could do the old utilman.exe hack[1] and get admin by replacing one of the programs on the login screen with a shell. If the device can boot without a password or PIN, there are some surprising ways to get into it just by switching networks (if network drives are mounted it will sometimes send NTLM hashes), or by good old brute-forcing. [1] https://blog.kaniski.eu/2020/12/utilman-exe-to-cmd-exe-and-back/ https://blog.kaniski.eu/2020/12/utilman-exe-to-cmd-exe-and-b...