It sounds like the encryption key is generated when the device is running as a combination of the UID and passcode/password, so it's not quite as simple as bein

It sounds like the encryption key is generated when the device is running as a combination of the UID and passcode/password, so it's not quite as simple as being able to decrypt everything straight away if you are the manufacturer. Even so, if they do have the UID that greatly reduces the security of the encryption - especially if you are using a short passcode.