Even if ubi were doing fine I doubt we’d ever seen it, and if we ever so, I expect another DNF case

And Beyond Good and Evil 2

Unless the crook happens to be extremely nerdy or its law enforcement, already being a Linux formatted partition feels it should be enough for a rando breaking in and stealing a computer.

That being said, something like a PiKVM connected to your server (and Tailscale) could let you enable both UEFI/boot password and propt for LUKS decryption upon boot.