Comment by Snoozus

The boot verification code wasn't replaced, because it sits in the encrypted partition.