The pin code gets entagled with a unique per-device key Apple calls the UID, the combination is what encrypts the data on-device. Only the Secure Enclave has a

The pin code gets entagled with a unique per-device key Apple calls the UID, the combination is what encrypts the data on-device. Only the Secure Enclave has access to the UID, but only through silicon, it can't read the key bytes. The Cellebrite rigs do use the Secure Enclave to brute force, but they're acheiving roughly 1s/guess, and the theoretical fastest is 80ms because the Secure Enclave uses PBKDF2 iterations tuned for that time. If you have a long numeric passcode or an alphanumeric passphrase you can be confident your iPhone is secure when it's off.