It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to reset the root account password This means without encryption you have no security what soever on your PCs unless you make sure nobody has physical access to them.
Isn't this considered as a major security issue?
It's a security risk, yes, but refer to this rule and read the link I posted. Actually, it'd be good to read that rule (Law 3) in addition to the rest of the Immutable Laws.
I'm not sure your question, "Are all OSes vulnerable to local password reset attacks" is within the scope of what we can answer; for instance, some popular operating systems might be, but perhaps there are a handful somewhere that aren't.
Passwords are sort of like locks. Locking your door might prevent a crime of opportunity, but it certainly won't deter a determined criminal. That's why you don't leave valuables in plain sight and you install an alarm system.
Think about it -- you can boot from a USB and read the data on the hard drive. That's a very possible attack vector. It accomplishes pretty much the same thing, yet saves them from having to go through the trouble of resetting the root/admin password. So, really, it's helpful for people who forget the root password, and isn't too much of an added vulnerability, because if it is an issue for you, then you have bigger issues in the first place (somebody with physical access to your machine's unencrypted data).
