That problem is solved by the Bootstap Token in modern macOS and MDMs which support it. The token gets escrowed with the MDM during enrolment and can be used to unseal the volume for updates without prompting for a password. Good for unattended updates to kiosks or whatever.