It seems to just fall back to the user's password, at least on my Hackintosh. That's not an exploit but it does require repeating a password.

I've never heard it said that it also explicitly doesn't do something like falling back to hardware encryption a la BitLocker. That's just paranoia-baiting though.