I don't have detailed information on FileVault, but all FDE (Full Disk Encryption) schemes perform best when computer is cold, namely shut down completely.
FileVault suffers the same weaknesses as other FDE schemes such as MS BitLocker and LUKS: while they secret key is stored on RAM an attacker with appropriate tooling may reset the CPU and dump RAM contents before the content vanishes. This is no simple thing to do, especially when hardware is compact enough. But is very well documented as a weakness of FDE.
Please note: data is always stored encrypted on disk. The data is not decrypted after boot. FDE decrypts only the data it needs every time, and decrypts that into RAM. Swapping a spinning disk has no effect with regards to security.
You said tech took 5 minutes to replace the key. I don't have record of how much time it takes to perform the hot boot attack, but data being volatile in RAM is matter of time.
I would be very confident that either:
- The tech did just his job to replace the hardware keyboard honestly
- In the back of the tech shop there were two techs paid by some government agency: one actually replaced you keyboard, the other was working to spoof national-security secrets (i.e. I am currently responding to a diplomat, a prosecuted national hero, a wanted terrorist or a mafia...) within 5 minutes of your arrival. They knew you were coming to that shop, they broke your keyboard on purpose to have you there, that day, that time. Mr. Bond would be a little surprised.
In short: I am confident your data is safe. Bomb me if I am wrong 🤣