[doawoo]

At a minimum you'd want to encrypt your rootfs using secrets that are hard to extract from secure elements. To go a step further you can employ something like ARM's TrustZone to hide away the sensitive operations (bootloader, decryptions, image signing, etc.)

The fact that they could just dump the filesystem tells me there's no protection employed at SpaceX aside from the boot loader mentioned in the article.