Yep. Physical access is equivalent to ownership. The only reasonable thing you can do to protect against it is to prevent access. Given enough time and physical access, any system can be compromised. Encryption is the only good prevention from them reading the data, but it isn’t foolproof, and backups are the only good way to ensure you can access the data after.