This is a vulnerability. This attack does not require physical access. Do you really think that startup repair mode is required to swap the position of cmd.exe and sethc.exe?
> Do you really think that startup repair mode is required to swap the position of cmd.exe and sethc.exe?
A Live CD/DVD would work just as well. As would a USB-based OS. You could also (although it would require more work) use network boot to run your own code.
There's no vulnerability, this is unfixable, you just have to secure the system using full disk encryption and secure boot.