[The question "what could go wrong" is rather broad, so this is not a definitive answer. I am also not a Windows certified security professional, I'm just spitballing.]
@CaffeineAddiction points out that when you leave a computer locked, all your user-level processes are still running. Imagine that an attacker is able to plant a backdoor, like running an FTP server; this would remain running while you're locked, but would the process would get killed when you log out. (That said, this only really stops script kiddies since hacker groups with enough money to buy black market exploits will probably be able to do privilege escalation and run that FTP server as admin).
RAM, cache files and network access: I don't claim to be an expert here, but I would assume that when you log out, Windows clears RAM and tmp files of any processes and data owned by your user. This would thwart a cold boot attack, or any other attack that allows the user to take a dump of your RAM. Windows domains also typically load your Documents folder - and often a user-specific network drive - from a network share. Logging out will close down the connections to these network shares - both preventing an attacker reading your data from the server, or planting viruses to the server.
I do agree with your skepticism though: if an attacker has physical access, why not plant something that will do all of the above the next time you log in? The old trick of crawling under your desk and sticking a malicious USB device in the back, for example.