Mind Blown , set/reset any root or user password (with physical access and USB boot)

Almost all security is a false sense of security. Not even the Pentagon can keep everyone out of their business.

I know of no arrangement where a logged-in user who opens malware (inadvertently or not) is protected whether the home directory is encrypted or not. If the malware is ruing under the logged-in user's account, then the data is effectively not encrypted, because the encryption layer is transparent after the key is enabled.

This is true for any operating system.