I have a Nexus 4 phone with full-device encryption. As I took it out of my pocket, it was displaying the "Type password to decrypt storage" screen. Presumably it had crashed in some way and rebooted, but how would I know this is the real decryption prompt and not some login spoofing malware app?
I powered off the phone and restarted, and curiously, it prompted me for my SIM card PIN first, only then for the decryption password. In any case, the power-off sequence clearly involves software (a long press of the power button invokes a touchscreen menu with only the power off option available).
This is Android 4.4.2, unrooted (as far as I know).