As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login password, if a person can just get the SSD out of my laptop and read plain data out of it.
This vulnerability sounds too obvious to be true, so I would like to know how putting a password on my Windows laptop protects my data.
As always, it depends on the threat model.
If the threat is a coworker or a family member without the technical skills or the motivation to remove a drive and mount it elsewhere to read its content, a password on an computer without an encrypted drive is a good enough protection to the confidentiality of its data.
If the threat is a malware (maybe targeted), like a remote access toolkit, protecting the computer with a password and encrypting its drive will not be enough to ensure the confidentiality of its data.
If the threat is US law enforcement, using the default encryption with the Microsoft Account will not ensure the confidentiality of the computer's data either, because a "backup" of the encryption key is sent to Microsoft.
But if the threat is a someone skilled enough who stole your laptop, or the next user of your stolen laptop, then full disk encryption combined with a password is a good enough protection of its confidentiality, assuming a TPM is present on the computer.
As A. Hersean says, it's all about the threat model. One scenario not mentioned by him is remote access. If you want to set up your system so that you can RDP or ssh into it remotely, or want to share your files over the network (which, I think, is enabled by default when you connect to a network that you haved marked as private), your windows password is what will protect your system from being accessed by unauthorized users. (And of course, remote attackers will not have access to your physical disk.)
Another place your Windows password is used to protect your data is DPAPI. In simple terms, this is a cryptographic API that allows applications to encrypt secret data using your Windows password, effectively protecting the data if somebody accesses your disk but does not know/cannot guess your password. For example, browsers may use it to protect your saved passwords and cookies. (Chromium does that, except they reduce the protection provided by DPAPI by using it in Local_Machine context.)
So, of course, a mere windows password is not equivalent in terms of security to full disk encryption, but it does protect some data in some scenarios and for some threat models.
