As always, security always operates with some threat model in mind. Of course some government-level agency with physical access and any amount of money to spend

As always, security always operates with some threat model in mind. Of course some government-level agency with physical access and any amount of money to spend could likely get access to your device (though the usual $5 wrench is probably still the "better" way) at the price of a (or a few) zero days. But you are likely not a key person in toppling a government and it would be a giant waste on their parts. The threat model the general populace faces ranges from something as mundane as your ex wanting to extract something from your device to basically being the know-all key to every important document, photo and data you might have. I think I can safely say that under this circumstances not even physical access poses a real threat to the device's security -- it is tamper-proof to replacing most critical parts and the boot-sequence is cryptographically secured. Biometric data is not stored in software, so not even that can be spoofed.