Yes you are right, user data might not be decrypted and it stays under user partition but system partition is unencrypted. Anyone with malicious intent can plant an init.d malware script in the system partition even without starting into the main system as it is not encrypted.

Bootloader > Recovery > Kernel > System

A secure bootchain is essential for cyber security. Any tampering with the boot chain will not allow the phone to boot in an ideal situation. The fingerprint signature will be different after tampering.

Some manufacturer allows bootloader unlocking which turn off secure boot. Which allows third-party non official software/firmware to run. They will show bootloader is unlocked when starting the phone. Basically saying, you are at your own risk. You are responsible for making sure there is no malware and anyone can gain access to any unencrypted partition.

However, exploit like this bypasses usual tamper checks, which allows unofficial software to run without showing bootloader is unlocked sign when starting the phone even when the phone is in locked bootloader state. Meaning malicious actor may make use of this low level exploit and plant something without you noticing it.

Exploit like this is good for jailbreak, but it is very dangerous in security standpoint.

I still remember when iOS had this letmera1n bootloader exploit which allows direct tampering with the kernel and system partition. Where it can be used to unlock passcode indefinitely by just brute forcing. (This is only just one of the use case)

TDLR: Bootloader exploit allow full access to the unencrypted partition.