Actually that's not true. The WindowsXP RC has the bootcfg command, with Win2k's doesn't. That's of little or no consequence in this discussion, but a case in point.
The fact is, this is a stupid security hole. Of course, we all know that if someone has physical access and is determined...