[Obscurity4340]

Keep in mind the default and what most people stick to is a simple numeric passcode, which can easily be bruteforced because you can just iterate through all the numbers. If the replay protection doesn't work they will be able to get in, its just a matter of time. If everything is working as it should and you use a proper alphanumeric/symbol passcode, I think thats less feasible if not downright impossible.

[abwizz]

i'd say that the amount of ppl that have this "delete data after 10 failures" feature enabled is vanishingly small, hence every passcode can be bruteforced