It's possible partly by the user shotgunning their own foot. WinRE gets auto-decrypt access to your drive because upon setting up BitLocker, the user chose "aut

It's possible partly by the user shotgunning their own foot. WinRE gets auto-decrypt access to your drive because upon setting up BitLocker, the user chose "automatically unlock this drive on startup" instead of a PIN unlock. (Which then utilizes the TPM to auto-unlock so it's not like your keys are on the storage device directly) If you use any non-auto unlock -- PIN, passphrase, network -- then WinRE can't magically access your data and needs that code to then retrieve a key from the TPM.