Let's track the RMA flow (the challenge/response mechanism you've tried out before it refused access because you're not a factory employee doing RMA repairs):

common/rma_auth.c:rma_challenge_response() calls process_response(), which on success calls common/factory_mode.c:enable_ccd_factory_mode()

That one calls factory_enable_deferred(), which resets the system before flushing all TPM data, and only on successfully removing all that proceeds to enable factory mode.

Therefore: gaining access through that venue also removes all secrets established on the system, including the TPM-part of the key used to encrypt the disk (the other part being derived from the account credentials, which isn't stored persistently anywhere).

(Disclosure: I'm part of the Chrome OS firmware team. If you find anything we forgot to do to protect user data, I'd _really_ love to know)