It is *remarkably* difficult to find something authoritative on this, but: how is an iCloud escrowed Filevault key protected? It can't be the iCloud password because that can be reset (although I guess that could just invalidate the key and then trigger re-escrow), it can't be your local password because if you know that you don't need the escrowed key in the first place - so what's going on?
(Ignore the corp escrow case, I only care about individual users escrowing with Apple here)