There are still attack vectors that can be used to attack your machine while the data is unencrypted, and they can simply scrape the password from the RAM of your computer. Adding a second USB device in addition to TPM and a secure password may provide a more secure option than a single USB device alone because the thief would need both to access your computer. Many forensic acquisition tools include memory dumping, so if the USB flash memory drive is stolen along with the laptop, you're aware of the compromise but unable to do anything if the adversary achieves this. It's worth consideration that the flash memory on a USB flash device can be attacked and read from when stolen.

A Password is Not Enough: Why disk encryption is broken and how we might fix it.

Building a Bulletproof Windows BitLocker.

In my opinion, a TPM is an important part of setting up BitLocker in a secure way. friend tricks you into running something) it can easily steal the encryption key (and do anything else). Other than that, it's worth remembering that if malware ever gets onto your machine (e.g. I think it's possible to prevent this through Group Policy, disallowing FireWire devices from activating if the device is locked.

If you have a FireWire port, it's possible to dump the active memory by exploiting DMA.

Someone shoulder surfs you and sees you typing in your password.

The memory dump can then be analyzed to retrieve the Bitlocker key (Elcomsoft Forensic Disk Decryptor can do this).

Someone with physical access to your device resets it and boots into a memory dumping utility.

Someone installs a small keylogging device that intercepts your keyboard (only applicable if you use peripheral keyboard).

However, if you have the scenario where someone has access to your device without you suspecting them, you are vulnerable to many attack vectors: On the other hand, thieves cannot get your password if they only steal your device and friends can't casually get it if they fit my common-sense definition of friend. Friends might also be able to get access to your USB key if you do not secure it. Thieves may be able to steal your USB key along with your laptop. So for the two adversaries you mentioned.

If you keep the USB key with you, it might easily be stolen along with your laptop.USB key will have some guaranteed cryptographic properties unlike most passwords.Humans are bad at choosing strong passwords.Password cannot be stolen together with your laptop.

The decision here is between something you know versus something you have.

Password usb flash drive