> I don't think this is actually possible with physical access — a properly configured system will at least require a supervisor password to disable Secure Boot.

That's assuming the case can't be opened to allow the supervisor password to be cleared by the usual physical methods.