on my laptop I have tpm to decrypt my drive and I’ve also enabled secure boot and set a bios password, so if someone steals my laptop it’s basically bricked,
secure boots there to prevent any potential tampering if someone were to take the drive out then put it back in
I feel this setup is secure enough for me, if you’ve got some nation state after you, or some guy with a wrench theres probably nothing you can do