I guess this means the system volume is not encrypted with FileVault? It makes total sense, since it’s supposed to be sealed, read-only data, and identical for every macOS installation.

There’s no reason you shouldn’t be able to boot all the way up including networking, before requiring the data volume to be decrypted.

I know they do a lot of clever things with overlays too, to make it look like you’re writing to the system partition when you’re actually writing to the data partition. It’s a pretty welcome change if FileVault can just skip encrypting the sealed system volume altogether.

Not always on networking; any WiFi passwords are on the data volume too.