The answer is actually anything between „nothing“ and „anything“ and depends heavily on the device and the scenario you‘re talking about.
Most likely scenarios would be:
- Nothing has happened
- A targeted attack using special hardware
The following assumes that the attacker did not observe you entering your passcode, which is a realistic scenario as well.
The USB attacks mentioned here are mostly effective against unlocked devices. While the attacker could leave something plugged into the USB port, there is a high chance that you‘d discover it before you unlock.
The attacker could „bug“ your device in other ways, but it would have to be done in a way that you don‘t discover when you return. That will be very hard to do in 5 minutes and requires pre-planning.
Someone who is after your data could of course simply steal the device, which is presumably unattended. Then they can spend more time and effort on the attempt; though you would obviously notice that it has gone.
If the device is off and encrypted, the only way to gain access would be a dictionary or brute force attack on your passcode; everything would depend on the security of that.
If the device is encrypted and turned on, the encryption will be unlocked. The attacker may be able to extract data from the running system. This may require some custom hardware and the difficulty will depend on the type of device.
If the device is not encrypted, reading the data is trivial.
The chance that a random stranger will just walk by and hack an encrypted, locked device is remote - unless you are at a security conference.
If you have to worry about being targeted, there may be a credible threat.
But if you‘re defending against a targeted attack, just thinking about the device itself would be too narrow in scope: The attacker could also try to slip an actual bug into your bag or jacket. Or try to slip a USB device into your conference bag that looks like swag, in the hope that you connect it yourself. Or try to film or observe your passcode when you come back, in preparation for a later attack.
Against a targeted attacker, „device not compromised after toilet break“ doesn not equal „safe“.
The most probable „attack“ is still theft - even if only to sell the thing. Or, if they want to vandalize the machine, they could also just spill coffee over it and be done.
 I noticed the part where it says you „trust it not to be stolen“, though it is hard to imagine a situation where the device would be „supervised“ enough not to be stolen and yet tampering goes unnoticed. Many or most of the techniques mentioned here (including rebooting and entering the BIOS) are more conspicuous than theft in the first place.