FileVault: How come a new user can log in without disk password?
From Apple KB - Use FileVault to encrypt the startup disk on your Mac
Emphasis mine...


  Enable users
  
  If you enable FileVault on a Mac with more than one user account, you're asked to identify which users can unlock your startup disk as part of setup. Click Enable next to a user name to let that user log in to your Mac at startup. Then, enter the password for that account.
  
  Users that you don't enable can't unlock the startup disk. These users aren't able to use your Mac until after an enabled user logs in.  
  
  Any new user accounts you create after you turn on FileVault are automatically enabled.