How so? FileVault is typically not tied to the root password, but to a primary user's password, which you don't even need root to change.

Yup. 'User accounts' have never been a proper security measure.