By my understanding, systemd is just handling the unlocking process and merely provides LUKS with your password/token communication. LUKS is the part that actually needs to be secure beyond systemd just not emailing your password to the gubment/north korea/4chan. LUKS unlocks its key store with the info you provide it which is used to decrypt the drive.