The chipmakers say physical attacks aren’t in the threat model. Many users didn’t get the memo.