The problem is more general than the case described and isn't specific to chroot, archlinux or linux.
In the general case, if an attacker has physical access to the system, they can read/modify any data stored on the disk, whether by physical means (removing the disk and mounting it on their own machine, possibly replacing it afterward) or through software (boot into their own OS and read/modify data without restriction as described in the original question).
As you hinted, a possible countermeasure against this would be to utilize encryption. This prevents an attacker who doesn't have the key (file, smartcard, password, etc.) from meaningfully reading or modifying data.
An attacker who encounters an encrypted system and is unable to recover the key can read the encrypted data (looks random) and write data which is unlikely to be decrypted meaningfully (equivalent of writing random bits to your HDD). They could corrupt/destroy data by doing so, but otherwise shouldn't be able to install/uninstall programs or change passwords.
In the case of full system encryption, the decryption key is required at boot time. Once the system is unlocked, then you can chroot as usual (assuming you have the correct privileges).
The way that this protects you is that you need the key in order to make meaningful read/writes of data and once the key has been inputted and the system booted, the OS's security measures (user authentication, permissions, ACLs, etc.) should kick in to control access.