It prevents access by casual antagonists.
If you really want to ensure zero access, you need to use a passphrase instead of key. This only applies to TrueNAS because of how it stores the config on the boot drive.
It’s possible (in theory) for TrueNAS to encrypt /boot as its own encrypted partition with LUKS, but I don’t think such a feature request will be accepted.