the reality is that evil maid attacks, and more broadly (and realistically) physical access attacks are exceedingly rare. The vast majority of stolen credentials are phished or some other social-engineering trick, not James Bond sneaking in with his badusb.