Other than the Cold Boot attack outlined by @security_paranoid, another way to extract raw encryption key from the RAM is to perform DMA attack, where the key is leaked out through an DMA-capable peripheral port like Thunderbolt.

This can be mitigated by IOMMU-based DMA protection, where the IOMMU hardware restricts supported peripheral devices to accessing only the memory area assigned to them, similar to how the MMU imposes memory protection between software processes. For unsupported devices, the mitigation is usually requiring logging into the machine before the device can be connected and used.

Without TPMs, devices are also ineligible to Secure Boot and thus susceptible to rootkit attacks where early-launch malware sits under the OS and extracts arbitrary memory content from the machine.

See BitLocker countermeasures article for more attack opportunities and defense measures.

Other than the Cold Boot attack outlined by @security_paranoid, another way to extract raw encryption key from the RAM is to perform DMA attack, where the key is leaked out through a DMA-capable peripheral port like Thunderbolt.

This can be mitigated by IOMMU-based DMA protection, where the IOMMU hardware restricts supported peripheral devices to accessing only the memory area assigned to them, similar to how the MMU imposes memory protection between software processes. For unsupported devices, the mitigation is usually requiring logging into the machine before the device can be connected and used.

Without TPMs, devices are also ineligible to Secure Boot and thus susceptible to rootkit attacks where early-launch malware sits under the OS and extracts arbitrary memory content from the machine. You can use the TPM + PIN authentication option to enable platform integrity validation and enforce physical presence (thus mitigating TPM-sniffing attacks) at the same time.

See BitLocker countermeasures article for more attack opportunities and defense measures.