Linuxios can already answered this but I'll see if I can explain in more detail. It's not always obvious why Physical Access = Game Over:
It is not a "flaw" because if an attacker has physical access to your computer, the login password cannot protect it.
If your data is not encrypted, an attacker with physical access to your computer will just remove the hard drive and put it in a different computer to read the contents. The attacker won't be running the operating system on your hard drive, he will just be reading the contents. Therefore, the prompt for your login password will never appear, as it is a function of the operating system.
As Linuxios pointed out, you can set passwords that appear when turning on the computer (aka BIOS/EFI passwords). However, someone with physical access can get around that requirement by erasing the BIOS settings (there is a jumper on most motherboards to do this), or by removing the BIOS chip entirely and replacing it with a new one.
Someone might point out that your keychain and home directory (if you opted to encrypt it) would still be secure - and that is completely true. That is exactly why you should encrypt sensitive data with a strong password, so that even if your computer is stolen, the attacker can't get it.