I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to add a user.
This is an obvious attack vector because somebody could use this to add an administrative user, install spyware, and remove the user without the owners knowledge as long as they had unattended physical access to the machine.
Is this a realistic threat?
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. (https://technet.microsoft.com/en-us/library/hh278941.aspx)
This is definitely a realistic threat. The question is whether you need to worry about it. If you can't guarantee that someone will not have unfettered access to your PC then you should be concerned and mitigate. This is likely the normal scenario.
If the PC is in a secure location where people don't have access to it, then it might not be necessary to worry about it.
Yes it is a realistic threat.
Here is a tutorial on how this is done.
The SAM file can be retrieved and cracked.
Alternatively, new credentials can be injected in the SAM file.
Defences include physically securing the computer, or (you've said it yourself) - encrypt the hard drive so it requires a password on boot.
