I would call out if it is a solder on TPM (or worse a removable module) MITM attacks work against the TPM. (I don't know why, but apparently new dell servers are still shipping with solder on TPMs and having the BIOS/UEFI firmware measure into that instead of just using the AMD EYPYC CPU's fTPM.) TPM isn't actually going and measuring anything on its own, it just gets PCR extend commands containing hashes sent over from the CPU that it has to trust are meaningful. If you can watch the bus (usually just SPI) it would be trivial to monitor the traffic to the TPM during a reboot and watch the hashes it is expecting to see, at least for the boot artifacts, which could be replayed into the TPM after it is disconnected, and then the TPM would happily unseal the secrets for the attacker's microcontroller, even for sealed secrets they weren't able to watch go past while monitoring. So, IMO against physical access the PCRs aren't doing a whole lot, and the whole thing is resting on a PIN. (Obviously this is a huge problem for servers, where a PIN is probably not in use.)