An "evil-maid attack" is the name used for the case when the attacker has unrestricted direct physical access for a short time to the computer, like it may be the case for the personnel who cleans the office or home in the absence of the computer users (or as it may be the case at some border control points if a laptop/smartphone is taken by the authorities for a checking done in another room, where the owner is not present).

With direct physical access, a lot of things can be done which cannot be done remotely, e.g. attempting to boot from an external device, possibly using hardware fault injections to bypass protections against that, attempting to read data that has not completely decayed from the DRAM modules, replacing some hardware component or inserting an extra component that would enable spying in the future, making copies of an encrypted SSD/HDD with the hope that after making other copies of it in the future that will enable breaking the encryption , if that is done using an encryption mode that does not protect against this kind of attack, and so on.