It depends on where you put that module. In NT you can have modules that sit between various operations on the file system. It’s how AV works without having to

It depends on where you put that module. In NT you can have modules that sit between various operations on the file system. It’s how AV works without having to hook into every single application that reads and writes from storage. There’s no technical reason why this kind of approach couldn’t be applied by Apple for encryption. But it would require relinquishing some control over their platform, so it would never happen.