From what I’ve read on various Graphene posts, if the phone has just been rebooted and you haven’t unlocked it yet, it’s considered at an at rest state which means everything is fully encrypted until you unlock your phone. If you have the feature turned on where the phone auto restarts after a certain amount of time of idle use this would help somewhat mitigate the situation you’ve described.