I see many comments in here saying it's obvious that a PIN can be brute forced. But it is absolutely NOT obvious that's the case because for a long time now we'

I see many comments in here saying it's obvious that a PIN can be brute forced. But it is absolutely NOT obvious that's the case because for a long time now we've had hardware like TPM and Secure Enclave. With that hardware, you can have the database's key securely stored with the PIN being what lets the hardware release that key. And even if the attacker has physical access to the device, it can be protected from brute force by having the hardware forget the key after a number of failed attempts.