If I recall correctly, some early techniques to unlock passcode-protected phones involved bypassing the user interface and trying passcodes at a point in the ex

If I recall correctly, some early techniques to unlock passcode-protected phones involved bypassing the user interface and trying passcodes at a point in the execution flow prior to the code that locks out the UI. I think modern devices have addressed this in various ways, but it’s not a good idea to rely on timed lockouts when it’s possible that techniques exist (or could eventually be found) to bypass the lockout. In short, assume those lockouts are targeted at normal users. A sufficiently motivated actor with technical resources is another story.