While threat modeling, you talk about specific scenarios and specific threats. That does not mean other scenarios and threats don't exist. It just means they aren't the focus of that particular conversion.

>In web applications and cloud services drives could still be misplaced, stolen, or improperly disposed of.

This is explicitly called out in the article by the author, despite it not being part of the threat model the author is examining. And people are still bringing it up like some sort of gotcha.

See (again):

>This is not a comprehensive blog post covering every possible use case or threat model relating to encryption at rest.