“The use of a discrete (physical) TPM does not increase the security of the system as one would expect and creates the illusion of security.”
A passwordless BitLocker setup on a Lenovo L13 sends the volume master key unencrypted over the SPI bus about 14 seconds into boot. A logic analyzer bought for under $100 clipped onto a neighbouring flash chip captures it. Mount the disk, swap sethc.exe for cmd.exe, press shift five times and you have a SYSTEM shell. Every IT department that told staff their laptops are safe “because BitLocker” skipped the PIN.