I can't imagine there would be a way to bypass that if a password is required, unless it was a situation where like, there was originally some secret secondary key made that needs no password... or the password was never tied to the key in the first place.
[1]: https://deadeclipse666.blogspot.com/2026/05/were-doing-silen...
That's the thing, we don't actually know how involved the PIN is in relation to the key... it might be completely separate (and hence bypassable).
Similarly I also wonder if password-based pre-boot auth is affected.
https://blog.scrt.ch/2024/10/28/privilege-escalation-through...
Not saying you're wrong, I'm just not sure how well known it really is.
Either way... if the TPM is the one gating the key behind a PIN, I really don't see how an OS-level exploit can work without knowing the PIN in advance.
Do you know how hard discovering even one of those is? And how many months of work it takes?
Assuming reasonable implementation standards at this point is the irrational assumption, not the rational one.