Probably the best setup to avoid this is to have something like Linux home folder encryption, and to set a separate account just for maintenance. If the device breaks, the technician is given the maintenance account password, not the one with access to your private stuff.