When this has happened to me, it's been about ensuring the device can turn on at all, they don't investigate what's on it.
with this concept of testing for actual electronic equipment vs nefarious object disguised as an electronic device my protections of shutdown still hold
Sure, but it's overkill. You'll have to turn it on anyway if you're selected.
Turning it on without logging in does not decrypt the FDE volume though. I'm only turning it off to ensure the decryption keys are not in memory. There's nothing on my laptop that would land me in trouble, but they're going to need a $5 wrench to get access. The day that happens, we'll know if it will need to be used, or if the mere presence of the wrench is enough
My approach is to replace the SecureBoot keys with one of my own signing, and sign my own bootloader. Have it boot into Windows unless a specific key combo is pressed, otherwise have it boot into Linux and require a password to decrypt the drive.
Plausible deniability and FDE (for the partition you care about at least).
Yes and if you refuse they confiscate the device.
Only time I was ever asked to login was in Morocco. It was an older agent and I assume he just wanted to make sure it wasn't a fake screen or something.