I don't know the full set of security measures on Windows RT devices, but if it doesn't have an effective hardware-level flash write protection in place, you should be able to change the policy with admin/kernel code execution rights, allowing for remote installation of a rootkit.

Besides, it is a worthy goal to protect a device from physical manipulation as well, i.e. to prevent border agents or secret agencies of a nondemocratic country from planting malware on your device.

The recent Apple vs. FBI debate has brought up a large number of arguments pro and contra protection from physical attacks.