Comment by OptionOfT

They don't have the tools but for 99% of the people who have laptop with device encryption, they mandate Microsoft Accounts, and guess where the keys are uploaded to? Thats right, https://aka.ms/recoverykey.

You don't need to build backdoors when you store a copy of the key.