When using swap with scratch, the image is now decrypted when copying from the scratch partition to the primary slot. Therefore, the sratch partition doesn't contain plaintext firmware data anymore.