For what it's worth, TPM supports session encryption, but the compatibility is poor due to bad TPM implementations (which is a whole extra can of worms), so it isn't enabled by default in most configurations. If this threat model is meaningful to you (which it probably is if you're using TPM-backed FDE), it's worth looking into what it would take to set up (and switch to fTPM if possible).

Although, if anyone wants an RE project, I've always been interested in reversing the ME <-> CPU bus on Intel to see if the ME-embedded TPM is still vulnerable to snooping. And of course all of this is still highly vulnerable to any early-boot / root of trust exploit (ie against Boot Guard / PSB or horrible UEFI firmwares).