His reasoning made me think about JTAG. JTAG can be used to inject test data into device. Basically you put data into device flip-flops (registers) by shifting

His reasoning made me think about JTAG. JTAG can be used to inject test data into device. Basically you put data into device flip-flops (registers) by shifting a long series of bits into special port. Then you perform a single step (computation of a function) and read resulting state from registers back. I think it is possible to inject PIN attempts into device and prevent device (by resetting it instead of performing step) to write over the key. Or even simpler - I think it is possible to read the key from device by JTAG operations.