I just did it on my MacBook Air with macOS Sierra 10.12.3 (latest macOS as of 02/2017) and that is indeed actually how it can be done.
As Tetsujin wisely points out, if you have the machine in your hands, then no OS is immune to a simple 'read the disk' attack - unless the drive itself is encrypted.
Of note Cmd+s invokes "Single User Mode" and there are other ways to bypass the login requirement, such as booting into local or internet "Recovery Mode" or booting the drive in "Target Mode". To avoid abuse of these options, you could also use a Firmware Lock. Per the article about "Recovery Mode":
Enable a Firmware Password to Lock Down Your Mac’s Hardware Even with
FileVault enabled, someone with access to your Mac could still wipe it
from recovery mode and set it up as a new system. A firmware password
can protect against this.
This will also help if you don’t want to use FileVault encryption for
some reason, but do want to prevent people from changing your password
and accessing your files. A firmware password also prevents people
from booting your Mac from other devices — like USB drives or external
hard drives — and accessing your files if they’re not encrypted.
Someone could still rip the hard drive out of your Mac and access its
files on another device if you just use a firmware password without
encryption, however.
If you set a firmware password, you’ll need to enter it before booting
into recovery mode or holding the Option key to boot from a different
device. Just powering on your Mac normally without doing anything
special won’t require the password, so it isn’t too much additional
hassle.
Also of note, per this answer, the impact to performance from activating FileVault on computers using SSD drives is negligible. The only difference the user will likely notice is the need to enter a password prior to booting... and remembering where you stored your "recovery key" should you ever need it.
