It's unreal, and it actually runs pretty well. The devs seem to actually know how to use the engine. I've had significantly less stutters in it than in some other recently released AAA unreal games.
Exception Level 2 [1] They're analogous to "protection rings" on x86. Generally, EL0 is usermode, EL1 is kernel mode, EL2 is hypervisor, and EL3 is the "secure monitor"/firmware code, closest analogy I think would be SMM on x86. On top of all of that there's also trustzone with its own EL0 and EL1.
Not exactly sure how the desktop Linux boot process is structured, but on windows with bitlocker the boot partition isn't encrypted either. UEFI has to be able to load a boot manager somehow, and unless you're going to splice in a DXE driver to your mobo's fw, which has the risk of bricking, to decrypt a partition, then you're always going to need a cleartext partition somewhere.
On windows the default way it's set up when you have a TPM though is that it locks the decryption keys against a hash of all of the code that has run during the boot process.