But it is not given that a user has physical access to the machine, is it?

Yes, I think the logic here is flawed. The only way to know someone can do something in the physical security theatre is by their doing it. Needing to cajole any normal user into running a script is a tad more optimal than convincing them to physically move devices from the server room to the new machine that they won in your raffle.