Yes, it took me some thinking but it's the conclusion I arrived at as well; the password is useless because as soon as somebody or something can run a bad proce

Yes, it took me some thinking but it's the conclusion I arrived at as well; the password is useless because as soon as somebody or something can run a bad process it's game over, first of all because all the files I really care about are owned by and writeable by me, and secondly because the bad process can just mess with .bashrc and get root access later. About the only benefit I could think of is slowing down an opportunistic attacker that finds my device unlocked, but even that could be game over with a quick `curl ... | bash` if the attacker is prepared enough. 'Security theater' was my conclusion as well, and I was surprised by it, why is everybody doing this?