I don't think this is meaningfully true for modern phones. The passcode is used by the phone's TPM to derive the actual encryption key, which never leaves the T

I don't think this is meaningfully true for modern phones. The passcode is used by the phone's TPM to derive the actual encryption key, which never leaves the TPM. TPMs are designed to be impossible to retrieve the secret key from without being physically destroyed to prevent the kind of attack you describe. This is why phone cracking devices like Cellebrite rely on exploits in phones rather than just cloning the disk and trying the small number of possible passcodes.