Since the device has to be powered on, but locked, and they're using a memory dump, they're referring to the AFU state, right?

From my understanding the BFU state is much harder given that the keys are not in memory but in the TEE. Although there has been exploits for that in the past, not sure if they can extract encryption keys.

It's also interesting to consider what's possible with arbitrary code execution vulnerabilities in early boot stages - would they be able to influence the ARM TZ?