Your system has mechanisms for running and debugging (like the init parameter) and it probably has security mechanisms to stop unwanted users from taking advantage of them. These are features, not bugs.
The bootloader is responsible for starting the OS. OS security obviously doesn't apply at that point. You could just load a different kernel, initrd, root fs or set different options (like init path). If you want to stop users from doing that, it must be done at the bootloader.
Your system (probably a PC, so BIOS) loads the bootloader and so, obviously, bootloader security doesn't apply to it. If you want to stop users from making the bios boot from USB or such, you need to do that on that level.
Your system may be on a desk somewhere. If you want to stop users from opening the coputer and switching the hdd for one of their own or removing the drive to mount it in their machines, you need to do it on a physical level. And it won't stop them from picking up the whole desk and driving away in their getaway van...
That's the way security is. Elephants all the way down.