That's how it works by default, but you don't have to use it that way. BitLocker can be used securely.

people rolling windows and saying high security environment in the same phrase are likely not aware what is a highly secured environment in the first place so it doesnt matter where those keys are -_-. I have never encountered these types of devices nor windows in a high secure environment. free software and BSD. Occasionally Linux but that is also mostly avoided or manually tampered with / built and hardnened to get around its rubbish security. sometimes there is an alternate deployment linux based (very hardened) in the event of a security issue on the other more secure platform in case that one does happen to spring a leak. (might be more needed now its easier to pick apart these systems).

some highly secure environments have connections comming from networks that sport windows. usually they will come in via something like a data diode so whatever comes in can physically not come out because its so risky to allow even such a network to connect to yours....

perceptions of what is highly secure can vary a lot depending on what a person has encountered. if you ever come across a place that is really secure u'll immediately know the difference.

ive never seen a highly secure corporate network and have seen close up what security is implemented in fortune100 etc. its a doozey. they just pay vendors with big retainers for IR etc. to be compliant and insured. that is not security. (and they spend millions on that which is funny as hell)

I suppose it works if your threat model is corporate espionage and not state actors.