Why would they implement the feature that way? Why not have a boot passphrase? Wouldn't you need some custom hardware to extract the keys out of RAM? And Google is in the right position to mandate some extra security hardware, if needed to provide a secure design.