You are right, and it is worth being precise about it because the distinction decides which solution you need.
A password prompt in a notes app is access control inside that app. It stops somebody who picks up your open laptop from browsing your notes in the app. It does not stop anybody from opening the folder in a file manager, or a text editor, or from a terminal, because the notes are exactly what they appear to be: markdown files in a directory.
That is not a criticism of those plugins — it is what they are for, and a deterrent against casual over-the-shoulder access is a legitimate thing to want. It is simply not encryption, and the danger is assuming it is.
What actually protects the content, in increasing order of effort:
1. Full-disk encryption. Almost certainly the right answer for your situation. Every mainstream operating system has it built in, it is a setting rather than a project, and it protects everything on the machine — not just notes. It defends against the laptop being lost or stolen, which is the realistic threat for most people.
What it does not do is protect against somebody using your account while you are logged in, because once the machine is unlocked the disk is decrypted. If your concern is a shared laptop with a shared login, this alone does not solve it.
2. Separate user accounts on the shared machine. Boring and effective. If the other person has their own account, your files are not readable from theirs, and combined with disk encryption that is a genuinely solid arrangement for a shared laptop. This is the answer to your actual problem.
3. An encrypted container or volume for the sensitive vault. A file that mounts as a drive when you supply a passphrase, and is an opaque blob otherwise. Keep the sensitive notes in there, mount it when you need them, unmount when you are done. More friction, genuinely encrypted at rest even while you are logged in.
4. Per-note encryption via a plugin. Some plugins encrypt individual notes' contents rather than gating the app. The file on disk really is ciphertext. This is real protection for those specific notes.
The trade-offs are significant, though: encrypted notes are not searchable, not indexable by your query plugins, and if the plugin is abandoned or you lose the passphrase, the content is gone. Test recovery before you trust anything to it — encrypt a note, then verify you can decrypt it from a fresh install.
One thing to watch across all of these: sync and backups. If your vault syncs to a service, encryption on your laptop does nothing about the copy on the server unless the sync itself is end-to-end encrypted. Check what your sync arrangement actually does, because that is where the copy you have thought about least is sitting.
My recommendation for what you described: separate accounts plus full-disk encryption. Both are free, both are settings rather than plugins, neither adds daily friction, and together they cover the shared-laptop case properly. Reach for an encrypted container only if there is something you would not want read even by someone with your login.