Asklemmy

Are you really worried about the case where a thief steals the hard drive but not the rest of the computer?

Even if the thief steals the entire computer, BitLocker/LUKS and SecureBoot provide a reasonable level of protection against data theft. Yes, the drive (or bits of it anyway) are automatically decrypted (the whole drive is never decrypted, just the data requested by the OS). However, it still prevents the attacker from accessing that data outside the intended operating system, which makes data theft much harder. An attacker would also need a valid account to login to the system to start accessing data. It's not an insurmountable hurdle, but it does mean that just having the computer isn't the same as having the data.

Without encryption, once a thief has the computer, they have the data. They don't need a valid account to access the data and they can even boot into a tool to reset passwords on the primary OS and start using it. Last I checked, chntpw still works with Windows 11. That sort of thing fails with encryption, even with TPM only. The TPM will not release the encryption key to an OS if SecureBoot fails. Granted, there is the YellowKey backdoor, but that was probably Microsoft giving the FBI a helping hand. But, that falls outside the intended design.