If someone steals my laptop, and there is no factor of decryption requiring something I possess or know, then the only use of that disk being encrypted is that I can throw it out more safely at end of life. Thieves/LEO has the data because they have the motherboard.
If bitlocker has a PIN/passphrase decrypt option, then I missed it.
While a thief or LEO could boot the OS, just having the motherboard doesn’t give them access to the underlying data. They would need to have a valid user account.
It was not made clear to me that my username/password was the decryption method! I was expecting something like Linux where a separate password is needed.
Furthermore it wasn't intuitive to me that my user account would decrypt more than just my home directory.
If bitlocker has a PIN/passphrase decrypt option, then I missed it.