I believe this is true.
When I forgot my "administrator" password a few years ago, I ran a google
search and found programs for sale for just this purpose. Then I asked my
system administrator (my home computer is supplied and maintained by my
employer ) and he said he had one those programs!
I came away convinced that a computer is not secure unless it's physically
secure.
Good luck, Dan Schaffer