You need the phone in an unlocked state to access the data though. There are tools[0] for brute forcing the PIN out there, which is why if you want to avoid such an attack you should a strong passphrase rather than a pin and turn off bio-metric auth.

[0] https://www.grayshift.com/graykey/