Microsoft has published information about a recent security problem classified as "BitLocker Security Feature Bypass" identified as CVE-2022-41099 which points out that Windows Recovery Environment (WinRE) images are at this time not automatically updated, but instead require manual steps to actually apply.
Installing the update normally into Windows will not address this security issue in WinRE. [..] You must apply the applicable Windows security update to your Windows Recovery Environment (WinRE).
That sounds like something only justified by exceptional circumstances, given how easily the provided instructions could results in breaking the feature altogether, and how deviating from the usual update methods will delay the updates application on many if not most systems.
A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device.
"Bypass" sounds serious, but at the same time impossible given that the same disk, encrypted the same way is on disk simply either protected or not protected, never conditional on the update status of the system Microsoft has setup to maintain it. Because if it did depend on that, the described "attacker with physical access" could just downgrade the software to get rid of that pesky security update, right?
What is going on here, how can this apparent contradiction be explained and what could qualify a BitLocker-enabled Windows system to justify the extra steps to update the its (never before serviced?) WinRE system.