Mac does not protect itself against Direct Memory Access (DMA) attacks before it is started. EFI which is running at this early stage enables Thunderbolt allowing malicious devices to read and write memory. The password is stored in clear text in memory and not automatically scrubbed from memory once the disk is unlocked. Password recovery have been tested and found to work on multiple macbooks and macbook airs (all with Thunderbolt 2) The attack is not tested on more recent macs with USB-C.”]
Source: http://blog.frizk.net/2016/12/filevault-password-retrieval.html