Sysadmin

No, this means the recovery key or other external unlocks have been lost, but the TPM chip is still working correctly to provide the bitlocker key during boot.

This is not bypassing bitlocker, simply bypassing loading the bsod causing crowdstrile driver by booting into safe mode. You still need a valid administrator account so authentication is also not compromised.

You would still need some kind of exploit to bypass the windows login screen.

No, that's not what it means.

If the device is wired to the LAN, the admin logon authenticates the user with the domain server, and thus decrypts the files using the credentials that are stored server-side.

If the drive would be fully encrypted, you'd have to enter a password each time you boot the machine. That can be done, but is really not all that practical, especially not when working with a domain server / remote admin.

For a private computer, you can have a look at Veracrypt (FOSS) if you want to have a fully encrypted drive.

Howso? It still requires authentication, same as if the laptop booted normally.