You are correct.

The uncomfortable part is what I’ve learned about the challenges to gain physical access.

Most physical security is equally appalling to most Cybersecurity.

Edit: Incredibly unfun exercise: pick a physical security device you rely on, personally, and do a YouTube search for “device name break in test”. I’ve rarely been able to find a video more than 3 minutes long, for any product, at all. And the actual breaking is usually mere seconds in the middle bit.