In some cases, they can attack the password outside the phone / device environment by comparing hashes. At the very least, such an effort may well be able to r

In some cases, they can attack the password outside the phone / device environment by comparing hashes. At the very least, such an effort may well be able to reduce the problem space considerably, leaving it down to a few guesses on the device.