It's not just the passcode they are recovering. That recovery requires the phone, but there's also the key reocvery and bit-to-bit image copy. The ElcomSoft describes the 3 statges:

- Extract hardware-dependent keys, file system keys and escrow keys from the device; - Recover the passcode (subject to passcode length and complexity); - Obtain bit-to-bit copy of device storage.