But it you create another admin account on the Mac can't you just reset the encrypted accounts password and decrypt with the new password? Maybe not but it's probably pretty hard to enter your password in an apple store in a way that nobody can see...

yeah i use vms for all my work (basically, or ssh into a vps) but the keys to the vms, the login sessions for emails, web browsing is all done on the laptop.

do you mean that even all your work email / all your web browsing do you within a VM?

can you technically explain a little more how that works?