Yes. What most don't realize is that you can remove LUKS full-disk encryption much easier ex-post (i.e. change your mind), than encrypting an existing non-encrypted system. With LUKS2 it's literally just making a backup for safety and executing one command to permanently decrypt the system.Entire drive encryption would be the most convenient solution, others could benefit from not doing full disk.
This is obviously not ideal. Depending on system specs, some alternatives are (1) a combo of PBA (bios password) and cryptsetup key in TPMv2, and (2) a fido2 token to secure the key.There has been no downsides for me other than finding the simple hiding issue (initramfs option)

