I want to completely restrict access to TBird. I know about the master Password but this does not go far enough. Unauthorised people can still read my old mail.
What are the options to have stronger security? Any add-ons?
It's not possible to do this with an extension. Your best guess would be to log off/lock whenever you leave the PC.
But you could file a Feature Request to the project.
It won't help you at all to restrict access to TB. If you use POP3 or use IMAP with offline folders, everyone can read your email having physical access to your computer.
All downloaded mails are stored in plain text on your harddrive. So you cannot protect them during a session. This affects Linux OS and Windows.
Try this on Windows:
On Linux OS, it's easier, but works similar:
With this little command line magic, you can read all mails.
There are some options to protect your Profile data in the mozilla Knowledge Base.
Take it with you and you won't leave it behind:
This will allow you to control access to Thunderbird to those who are physically holding the actual USB device.
If they don't have the stick, they can't access your emails (unless they log in elsewhere) and they can't read your old emails.