It is not "terrifying". It's a perfectly reasonable thing to expect when you surrender physical access to the device. If an attacker has physical access to the device they want to attack, and can operate without fear of the proper owner catching them in the act, they can do anything with that device.