>> Isn't a secure boot policy that can be bypassed with physical access more secure than none? >Of course it isn't.

Really?

Suppose that you are choosing a new device. You can choose one that let's a remote hacker install a rootkit via a malicious website, or you can choose one that let's a hacker install a rootkit only when they have physical access to your device.

Which one do you choose, and why is it the latter?