If you are using any type of pre-boot /OS level, or per-mount encryption it usually keeps anything protected accessible until you shut down. If you log out, but the system still needs access to application that would otherwise be encrypted that means the data can still be accessed and that it is either decrypted or that the decryption key is still in memory. Session management is usually disconnected from file encryption.
This means that if you had malware running on your system and it was not tied to your user session, it would continue to run even when you are logged out.
From your OP it sounds like you are talking about physical access attacks. If you can connect the locked system to a network or use a usb device which is masquerading as a ethernet controller it may be possible to spoof your real network and to carry out attacks. A good example is PoisonTap.
PoisonTap produces a cascading effect by exploiting the existing trust in various mechanisms of a machine and network, including USB/Thunderbolt, DHCP, DNS, and HTTP, to produce a snowball effect of information exfiltration, network access and installation of semi-permanent backdoors.
There are other similar implementation, such as Rob Fuller's and BadUSB. You can use an app like USBGuard to prevent these.
Hypothetically, an attacker may also be able to install a more basic keylogger that you may not notice and then they can obtain your password to your session this way with physical access. There have also been live physical memory dumping attacks in the past and new ones may be discovered.
As a result, if you are in an untrusted environment in terms of physical access you should do a full shutdown to prevent any access to encrypted data. See also this post on the topic.