[d0]

There is an issue with user switching and firewire/DMA that allows remote access as well as cold boot attacks but these are out of reach of most people.

[acdha]

firewire / thunderbolt DMA access was fixed many years ago: if you enabled a firmware password, those buses have DMA disabled.

[toomuchtodo]

Are you saying that if I have a firmware password on my MBA that my internal SSD is inaccessible via Thunderbolt externally (until I've entered my password)?

[aroch]

No, but your TB device wouldn't have read access to physical memory (where keys would be)

[acdha]

No - but it means that a device can't read your FileVault keys out of memory so all they can read is the encrypted volume.