AFAIK, almost every device is more secure BFU.
Also if the phone is on and was unlocked at least once, the encryption key is in memory somewhere and is vulnerable to regular old software exploits.
(Both of the above can be prevented by shutting down the phone before the search attempt)
Finally, if there’s a vulnerability that lets you reset the number of passcode attempts (which has to be loaded in memory somewhere, meaning a bootrom or kernel exploit could be used to modify it) and your passcode isn’t super long (4-digit PIN, some 6-digit PINs, pattern lock), it’s possible to make what is effectively a password guesser and use it to break the password lock within an hour or so.
There is a shortcut, however, on iOS to secretly put an iPhone into BFU mode - quick tapping the power button 5 times will lock the phone and erase the aforementioned in-memory keys so that it needs a password to unlock.
(EDIT: it does not actually put the iPhone into BFU mode. It just disables biometrics.)
People should never use apps that sync to something else than their own servers.
Apps are sandboxed. I don't see how it's possible.
How many phone apps there are these days that are strictly local storage and don't communicate externally to anywhere? It's all cloud cloud cloud, which means it is most likely passing through one or more MITM points.
I don't think they're lying, after all if they did they'd lie about much more common mobile OSes too. But personally I wouldn't inform the public of my weaknesses if I were a 'security/forensics' company.