Howto change the Apple logo after Filevault login?

When you have an encrypted disk with FileVault, the system needs to ask for an authorised user to login just after EFI boot. (no news here, just enforcing what most people know)

That logo shows your avatar because your user's avatar is inserted on the EFI boot image/nvram. At this point of the boot sequence, there is no Operating System loaded yet, it's just a simple boot screen to ask the user password [which simulates the login screen of the GUI], but it just a static image containing the user avatars.

After you insert the password, the disk is mounted, and the boot process begins.

After the loading bar reaches about 80% that screen changes to another almost identical, it sometimes blinks at this point. This is the GUI interface being loaded, process called WindowServer. Your avatar is not shown on this phase. To modify it would require to change protected SIP system files (if possible) otherwise you cannot easily change it.

This is how the boot sequence works for Encrypted Filevaut MacOS systems.

If you boot it using the "-v" nvram argument you can get a better view of what is happening "behind" the scene, and also can see the GUI loading moment.

If you open the Console.app and change your avatar on System Configuration you can see the moment it writes you avatar to the nvram [only for FileVault encrypted system this occurs]

My answer is a partial answer just to clarify how this is technically done and help describing how this works. I hope it can be valuable to help you [or others who are reading this] to reach your goal for changing it.