Would my laptop be secure against physical access if I set up a bios password and full disk encryption ?
If not then is there any way to secure your laptop from someone with physical access?
How hard would it be to hack into such a laptop? How long would it take? What methods would be used? Does it matter if the hacker is on his own or if it is a government agency?
As far as I know, BIOS passwords are not secure in some cases (or most cases) because on some devices (or most devices?) they can be reset if you have physical access, by removing an internal battery, or tampering with the hardware in other ways (jumpers, replacing the firmware, etc.). For some devices if might be easier (for example for desktop computers that are easier to disassemble), for other devices it might be harder, but in the end if the attacker is skilled enough you are probably screwed.
FDE (Full Disk Encryption) protects you from threats where your data is stolen at rest, that is, for example, if you laptop is just stolen while it's turned off. It's not meant to protect you in other cases, and definitely not if the attacker has physical access.
With physical access, an attacker can try a lot of tricks, depending on their expertise and resources, and depending on what kind of physical access they have: if fully unrestricted (access at any time, for long periods of time) or somewhat restricted (access possible only at a specific time, or for short periods). There is definitely a lot of difference between a single hacker and an organized hacking group, or a government agency: the difference lies in their resources and expertise. Your geek friend might be willing to invest at most $100 to hack you, while a government agency will have no problems investing several thousands of dollars.
There are several tricks that might be used to hack your laptop. From flashing the firmware and replacing it with an infected one, to adding a hardware keylogger anywhere inside the machine (or even outside if it can be hidden). An interesting trick involves replacing your laptop with an identical copy that will transmit your keystrokes in real time. You will turn it on thinking it's your laptop, type your passwords that will be sent in real time to the attacker, and by the time you realize that it's fake you are already screwed.
How do you protect from physical attacks? Of course with physical security controls. In other words, you need to prevent attackers to be able to get near your machine. Some typical examples: alarm bells, gates and fences, locks, armed guards. Remember that not all security controls are worth being implemented, because they always depend on your specific threat model. I just lock my door and that's it, for example, but I'm not a wanted criminal that fears government agencies. If I was, I would probably hire an armed guard.
The BIOS password is of no real significance assuming unlimited physical access. It might be an effective delay against someone with extremely limited access time.
Full Disk Encryption is your protection.
Modern FDE is beyond realistic brute force attacks, extraordinary luck or non-existent quantum computers not withstanding.
Ignoring Evil Maid variants where you are tricked into providing the encryption key, the strength and availability of your password or encryption key dominates.
Assuming a strong password/phrase, the biggest question is where do the keys exist?
If the keys are only in your head, then that's the practical target. There's the classic XKCD as well as numerous legal cases involving forced production.
It's actually very common to have the encryption keys/passwords available via other sources. Microsoft Windows makes it very difficult to NOT backup your recovery keys. Many people save passwords and keys in a safe place such as: a literal safe, safe deposit box, with a friend, or frozen in an unused ice cube tray. These alternate sources are the other most viable way of getting into an FDE drive.
Your random thief is not going to have access to legal recourse or in depth research into friends and family in order to obtain these other backup keys, Law Enforcement is a different story.
