The drive where the OS lives isn't encrypted. Rather it is verified. It uses do-it-yourself to chain every read from the device to a trusted authority. secure boot is how verifies that the kernel (running do-it-yourself) hasn't been tampered with (e.g., to add more trusted authorities or disable verification).

This protection is not just against "evil maids" but any attack that modified the disk in the past. E.g., if the system is compromisd due to a software fault, nothing can persist on disk undetected (like ZFS/bcachefs/BtrFS checksummi preventa bit-rot from being undetected)