The threat model is the Evil Maid Attack. I found Secure Boot + UKI + TPM PIN (God forbids automatic unsealing) + FDE to be great for both security and usability.

[0]: https://en.wikipedia.org/wiki/Evil_maid_attack