https://developer.android.com/privacy-and-security/direct-boot
was also helpful. It tells apps can decide their functionnality doesn't need user encryption but only device encryption (unlocked by validated boot). Maybe this is how bluetooth pairing and wallpaper are available.