Something like that. I’m not familiar with the exact details, but there is an additional layer of encryption that applies before the first unlock after a reboot.

Parts of the OS have to be unencrypted for it to function properly.