Meet PoisonTap, the $5 tool that ransacks password-protected computers

There are plenty of other tools that do this. Many are free, lightweight, and multi-platform.

Physical access might be a vulnerability but as an attacker, I can create custom malware that does this and send it via email or use a remote code execution vulnerability on the target system(s) to harvest the passwords.

It's a scary world out there... stay paranoid.

this is most interesting...

So many ways to do this. keep everything as secure as you can , but know there are so many ways in nowadays that nothing is guaranteed to keep you safe anymore.