In this case the wallet was stolen from the machine after it was rebooted into single user mode. With FDE the machine wouldn't have been usable when it was rebooted so the attack wouldn't have worked.