As far as I understand, the device's
/data partition remains decrypted once an encrypted devices has been unlocked during boot up. Why does Android have to keep encryption keys within RAM if no "live" decryption / encryption is actually happening?
I think you understand the concept wrong. The encrypted partition will not be fully decrypted on mounting, then stored somewhere on the device and then encrypted again (to save the changes) whenever the partition gets unmounted. Instead the key is known the the kernel (i.e. it is in RAM) and it can thus decrypt and encrypt data on the fly.