Hm, isn’t the trick is to have a separated account just to boot into with a strong password and remove the primary account from a set of accounts allowed to unlock the disk? I have used that on older macos not to bother with reinstallation of os to enable password-encrypted partition.