> You mean the attacker having a physical access to the device plugging in some USB or UART

... which describes US border controls or police in general. Once "law enforcement" becomes part of one's threat model, a lot of trade-offs suddenly have the entire balance changed.