As far as I know, BIOS passwords are not secure in some cases (or most cases) because on some devices (or most devices?) they can be reset if you have physical access, by removing an internal battery, or tampering with the hardware in other ways (jumpers, replacing the firmware, etc.). For some devices if might be easier (for example for desktop computers that are easier to disassemble), for other devices it might be harder, but in the end if the attacker is skilled enough you are probably screwed.
FDE (Full Disk Encryption) protects you from threats where your data is stolen at rest, that is, for example, if you laptop is just stolen while it's turned off. It's not meant to protect you in other cases, and definitely not if the attacker has physical access.
With physical access, an attacker can try a lot of tricks, depending on their expertise and resources, and depending on what kind of physical access they have: if fully unrestricted (access at any time, for long periods of time) or somewhat restricted (access possible only at a specific time, or for short periods). There is definitely a lot of difference between a single hacker and an organized hacking group, or a government agency: the difference lies in their resources and expertise. Your geek friend might be willing to invest at most $100 to hack you, while a government agency will have no problems investing several thousands of dollars.
There are several tricks that might be used to hack your laptop. From flashing the firmware and replacing it with an infected one, to adding a hardware keylogger anywhere inside the machine (or even outside if it can be hidden). An interesting trick involves replacing your laptop with an identical copy that will transmit your keystrokes in real time. You will turn it on thinking it's your laptop, type your passwords that will be sent in real time to the attacker, and by the time you realize that it's fake you are already screwed.
How do you protect from physical attacks? Of course with physical security controls. In other words, you need to prevent attackers to be able to get near your machine. Some typical examples: alarm bells, gates and fences, locks, armed guards. Remember that not all security controls are worth being implemented, because they always depend on your specific threat model. I just lock my door and that's it, for example, but I'm not a wanted criminal that fears government agencies. If I was, I would probably hire an armed guard.