Because that's how you model your threats? You assume things like someone won't be able to physically take your RAM and read whatever data they want, for exampl

Because that's how you model your threats? You assume things like someone won't be able to physically take your RAM and read whatever data they want, for example. If you can't assume that, then you implement measures against it like soldering the RAM to the mainboard.