It depends on your threat model. Just enabling BitLocker will defeat someone from plugging in a Linux live USB and resetting your Windows password. For corporate security ATA Secure Erase done by a vendor who accepts liability and gives them a "certificate of data destruction" may be enough to meet HIPAA, FERPA, SOX compliance requirements. Or they consider drives cheap enough that physically shredding them to ensure no mistakes is the better choice. At the national security level you pulverize the drives after zeroing them.