I mean, they could also just saw open the box or rip it off whatever mounting brackets it's on. At some point you have to acknowledge you're making unauthorized access inconvenient rather than impossible.
I'm not an absolutist, what I'm saying is that bruteforcing 10 or 16 states is neither inconvenient nor impossible. Its a lot less risky than spending time sawing open a lock box.