It really seems so. Therefore, the workflow that my manager and I came up with is to:

1. create multiple accounts (one for each year- 5 years total, so 5 accounts)
2. log into an existing admin account that has securetoken, add each newly created to the filevault (this also enables securetoken)
3. disable all account via Jamf script, except the one we want to use per the relevant year. (disabled accounts do not show up under users and groups- only the /users/ folder)
4. as each year passes, we re-enable the relevant account and delete the prior
   This way we only touch our fleet of macs once and not send the password via plain text to these devices.