If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities goes away.

It's probably all security theater. There's only so much trust you can put into some shitty vendor's TPM implementation