A creative user with a Windows laptop can do it easily unless it’s really tightly locked and controlled.

Of course it's not actually zero.

There's always someone whose finger can't poke things that will ask where the mouse is, or why this stupid iPad doesn't run Lotus 1,2,3 -- and you have to respect their challenges. Or of course (rare) hardware faults, and you have to provision a new one.

But the appliance-ness of it makes it a support dream.

Much harder to actually break or make unusable than the typical 5-10 yr old windows laptop from the lowest bidder most people interact with.