A thought experiment. If I had physical access to a PC that was switched off, but I didn't know the password, could I boot into a live linux image and install software on the windows box? Software like netcat for example
You have write access to the machine's hard disk, so you can add and modify files at will.
Running an actual installer would be tough, but decompiling the installer and then manually doing all of its work (copying files and editing the registry) is possible. Another option is to run the installer on a clean VM, compare the before and after state of it (which will list all modifications made by the installer) and then "replaying" these modifications on your target system is also possible.
From a security perspective though, malware usually doesn't come with an installer, it's either a single .exe that you put somewhere hidden and then add the corresponding registry entry to make it run at boot, or you completely replace critical system files with your own (malicious) ones.
You wouldn't be able to install anything, as the windows machine would be off. You could possibly mount the windows partition and copy a executable, script or anything else harmful on to the windows partition though.
Preventing something like this would be quite trivial and would only require bios encryption, password protection to prevent you booting to the live instance of linux and encryption of the windows partition.