An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at the machine. In that case, the BIOS password protects... the BIOS settings.
The two settings which the attacker may want to alter are the current date, and the boot sequence. The boot sequence is rather obvious: by changing it, the attacker can make the machine boot off a USB key he brought, instead of the hard disk, giving him full access to the hard disk and its precious files.
Changing the date is more an edge case; by making the machine believe it is in the far past, the attacker may trigger some other behaviour which could impact security. For instance, if the OS-level logon uses smart cards with certificates, then the OS will verify that the certificate has not been revoked. If the attacker got to steal a smart card with its PIN code, but the theft was discovered and the certificate was revoked, then the attacker may want to alter the date so that the machine believes that the certificate is not yet revoked.
Recent machines may use something called UEFI: a new standard for booting operating systems. One feature of it is that the bootloader can be signed, and the BIOS verifies that signature; it won't boot an unsigned OS. This is called Secure boot. However, most BIOS allow for the deactivation of this feature. This is another BIOS setting that the BIOS password can protect.