Not a safe assumption. Besides, the best way to erase an encrypted volume is to forget the key. That trick let’s you erase TB of data in under a second.

> We are not sure of the real advantage introduced by encrypting the
> EncryptedRoot.plist file. This file contains the keys in an encrypted
> blob (therefore security measures have already been taken), but the
> key to decrypt the file is available as plain text in the header of the
> CoreStorage volume (so any attacker can do that; for a dictionary
> attack, as detailed earlier, an attacker only needs to decrypt this
> file once).

The purpose of encrypting this file is obvious given that its name is EncryptedRoot.plist.wipekey — clearly it is encrypted with the “wipekey” from the header such that overwriting the sector(s) containing that wipekey will cryptographically wipe the volume (assuming true overwrites are possible on the media, and that attackers have not previously had access to the media to copy the key).