A standard pitfall of disk encryption on Linux is needing /boot unencrypted. Specifically the bootloader and initrd. Encrypting the entire disk means putting those somewhere else, e.g. on a USB stick.
edit: I have now learned that grub can now decrypt a filesystem containing the kernel at boot so it's only the bootloader that needs to be unencrypted under Linux
I am under the impression that it's "known" that FileVault implements whole disk encryption. I certainly believed this was the case. This is slightly difficult to demonstrate without a bunch of links to external sites. A couple of internal ones:
And an existing question that answers essentially this question is-file-vault-2-whole-disk-encryption-or-whole-partition-encryption
It seems fairly clear that file vault works at partition granularity and that Apple uses a separate boot partition. I can't find any evidence to suggest that file vault can be used on the boot partition.
I don't understand how it can boot so far as to offer a login prompt if the whole disk is encrypted. What am I missing?
For reference, the system I'm interested in is using apfs rather than cs and does not have a T2 chip.