I have not worked in that field specifically but on the peripheral, and know how bad it could be. I always say, physical security is the most important. If I can touch your shit, I own your shit. Simple as. Too many people rely on all sorts of protection but forget I can come steal the device. And the encryption key that’s on the usb, or a post it note. Audited a client friend once. Here is a list of these people’s passwords. “How you get those” stood outside after dark with field glasses at the window and looked at all the notes on the monitors. Oh yeah that’s not good. Nope and your building exterior is not secure by anything, even a fence.