Assuming the NFS server isn't mounted on the image once it boots, it's no storage. I would hope that's the case, and that the NFS server is configured read-only, but they don't explicitly state it in the article.
They don't and they encrypt it, why encrypt something that is read only? So i can only assume that it is writable for configurations.
The NFS is read-only, and encrypted. The connection to the NFS server is terminated directly after the image has been transfered and unpacked into the RAM memory.