It's quite common in many environments. In particular, I've seen lots of academic environments where a room has been "modernized" to be a computer lab, but since the facility wasn't designed for it, there isn't a separate lockable closet or room for servers and networking gear. In many colocation centers, there's a security guard at the door who will verify permission to remove equipment and log such removals, but internal protection will typically consist only of fences and video cameras, and there are easily exploitable weaknesses.
Security is a complicated thing. It is worthwhile to note that most locks are designed to keep honest people honest, and that virtually no amount of security will keep a determined, well-resourced attacker from being successful against you. I like to explain physical security with the door analogy:
Think about a door. You can close your bathroom door and set the privacy lock, but any adult with a solid shoulder can break that door, or with a pin (or flathead or whatever your particular knob uses) can stick it in and trigger the unlock. Your front door is more solid, but if it's wood, and not reinforced, I'll give my steel-toed boots better than even odds against it. What? You have a commercial hollow steel door? Ok, that beats all of that, let me go get my big crowbar, a little bending will let me win. Something more solid? Ram it with a truck. You got a freakin' bank vault door? Explosives, torches, etc. Fort Knox? Bring a large enough army, you'll still get in.
Console logins are a completely reasonable level of defense for certain environments. Consider a small office where the fileserver might contain sensitive materials such as payroll data or the boss' e-mail. Do you really want to trust that someone with a little Linux experience isn't going to get curious, one night when they're working late, all alone, and go poking around and looking at files?
So, let me wind this up as follows:
You're RIGHT, in any environment where an adversary could accomplish goals via theft, securing the server from physical removal is a necessary step.
However, in some cases, theft of hardware is a trite goal, because hardware is worth relatively little, and alerts the victim of the event. In many cases, it is the information *on* the server that's of true value, and it probably isn't that hard for someone to come along, attach a USB drive, run a few commands through that unprotected console interface, and have a copy of your juicy data. Or, worse, log in, twiddle the FreeNAS database, adding an additional user who then has access to shares until either someone notices or the server is reloaded and reconfigured from scratch, which might be months or years of illicit access.
There's a reason that most gear offers the option to protect its console. FreeNAS definitely has the capability to do what we're talking about, by the way, there's just no WebGUI checkbox to cause it to happen. My previous suggestion in this thread is sufficient for people who find themselves with such needs. It would be kind-of nice to see FreeNAS support this though, it probably wouldn't be too difficult to add some logic in /etc/netcli to do this.
