“Some person with physical access to the computer” absolutely is part of the threat model.