Exactly and to elaborate, it means that the only secret a user needs to remember is a short PIN for OS-level authentication. The TPM's protection against modified boot and OS components make a brute force very difficult. Further, Windows will actually feed that PIN to the TPM for purposes of OS-level authentication, which leverages the TPM's enforcement of rate limits and lockouts in addition to OS-level implementations of those protections.

A nice improvement would be to use a PIN entered at boot for purposes of drive decryption and then automatically pass it through to the OS-level login.

And for a server it enables to reboot autonomously while protecting you from someone pulling a hard drive from the array (think server colocation).