As far as I can figure out, you also need to opt for manually unlocking bitlocker via USB key (prone to copy/theft) or via typing in a passphrase (inconvenient) in order to safeguard the encryption key.

Windows will otherwise use hsm to store your key (as evidenced by eg face unlock working) - it's not at all clear how that could possibly be secure if an attacker steals your device?

If the key is in the HSM, then what's protecting your data is the trust in the boot chain not being broken, and the OS login not not being compromised (theoretically).

Booting an alternate OS, or removing the media will result in the HSM not giving up the key, and rendering the drive unusable for all attackers except those able to physically probe the HSM chips and extract keys. (theoretically)

Right. It's not really the hsm itself I worry about (although as we saw with the Xbox hack people are able to do some crazy stuff) , but the possibility of working around/breaking the os login manager - manipulating the camera or hooking up a custom "keyboard" or some such.

For example i have trouble trusting pin login against brute force when the attacker has unrestricted physical access - including the possibility of replacing/manipulating the ram chips etc.