AFAIK it’s not that easy to access data on the machine while it’s running unless they can bypass the lock screen. People pick stupid passwords for their user accounts so it’s totally possible to get in in those cases, but otherwise dont you need really sophisticated side channel attacks to get data out of memory on locked system? It’s not like there is some port on the MOBO you can just plug into to get access to RAM