You say that like it is a property of GNU/Linux, rather than a property of physical access.

Encrypted hard drive can make it hard to crack, even with physical posession. The advantage here was, you get to run code while they are logged in and the hard drive is happily unencrypting whatever you wish to see.

The govt desire was apparently to non-destructively crack a machine with only brief physical posession, without leaving much trace. The method in the article satisfies that.

Good think that I'm only running a Linux machine.