Most laptops have provision for booting from an USB disk. If this is not blocked at BIOS level, an attacker could boot on their system disk, and then mount your physical disks and do whatever they want (read/write). This a the standard way to (re-)install a system.