Copying data in recovery mode - is this a security flaw?
That is what Filevault is for.

If a bad actor has your computer in their hands you need encryption to keep them out. No encryption, no security.

Even if you have the computer firmware password protected, that wouldn't prevent them removing the drive to access from another machine.