On Dell devices in that age range I saw a bitlocker mode that used the drive controllers own encryption feature. I dont remember if the key was provided by tpm but they used attestation. I dont know if they had a key unwrap dependent on that attestation or if it was just a postfactum check that is submitted to management servers.

In that course I have seen a bunch of blog posts where people found bugdoors or easy auth bypasses in these drive controller encryption schemes. Is that still a thing?