An attacker with physical access can abruptly restart the device and dump RAM, as analysis of this memory may reveal FVEK keys from recently running Windows instances, compromising data encryption.
The effectiveness of this attack is, however, limited because the data stored in RAM degrades rapidly after the power is cut off.
Yes, assuming it’s durably sealed and tamper-proof. If you have enough physical access, though, you can remove the DRAM and put it in another machine to scrape it. This adds time, but it has been done before. One experiment dipped the DRAM in liquid nitrogen for an hour, and found 0.13% decay.
Yeah you really need a password or TPM PIN protector to protect from cold boot attacks if that is in your threat model.