They most likely do, both password and FileVault. The idea is to intentionally leave a barely-functional Guest account available to anyone who opens the laptop. Those in possession of the laptop start using it and the tracking software phones home with location, photos, etc. This is even a best-practice suggested by Apple; its quite effective.