I don't really understand the threat model in which this provides a real security benefit. If someone can inspect the contents of memory, can't they also recove

I don't really understand the threat model in which this provides a real security benefit. If someone can inspect the contents of memory, can't they also recover the encryption key somehow?