It's possible to inject code into RAM via this method as well as read it, bypassing said login screen. With FileVault, once you unlock the disk, it remains so until you shut down. Shutting down prevents an attacker from having access to unencrypted data via this attack.