This ensures that even if a bad actor has physical access to the machine, they cannot load a separate operating system to circumvent the installed OS security.