The crypto code decrypts the streams through recursively accessing the indirect objects. For external files it may not easy to determine a file stream is an embedded file from the attributes of the extent dictionary of the stream as all the keys are kind of optional. So Filespecs should be implemented properly to identify the case where EFF flag has to be used judiciously.