There are ways to break File Vault 2 encryption: https://www.blackbagtech.com/blog/2017/07/13/macquisition-best-just-got-better/
Since you can reset a password when it's locked, I wonder in practice how secure is FileVault in the real world.
Furthermore, even if someone like the aforementioned Macquisition isn't used, can't someone just login to your user account?