The attack is a brute force attack. My understanding is that if a secure enclave is present, then the PIN timeout feature which prevents brute force is impleme

The attack is a brute force attack. My understanding is that if a secure enclave is present, then the PIN timeout feature which prevents brute force is implemented in the secure enclave. If the secure enclave did not permit updates, then this logic would be relatively unassailable. But since the 5C has no secure enclave, the PIN lockout logic can simply be overwritten by updating the OS.