Comment by gray_-_wolf

> The attack is not applicable to LUKS1 format, but the attacker can update metadata in place to LUKS2 format as an additional step.

First time I'm glad grub cannot boot LUKS2.