How can adding a new user bypass full Disk Encryption?
Normally, when you set up full-disk encryption on the startup volume, you use FileVault, which integrates the disk encryption with the user accounts, so any (enabled) user can start the OS and unlock the disk. It appears that what you've done is encrypt the startup volume some other way, giving it a disk password rather than integrating with the user accounts. But when you create a new user account, it goes ahead and sets that account up FileVault-style, giving it the ability to unlock the disk at startup.

Not what you wanted? You can remove that user from the unlock list with the fdesetup command:

sudo fdesetup remove userToDisable


where userToDisable is the new user's account name (aka short name). Note that sudo will prompt for your admin password, and it won't echo as you type.