See also, 5th amendment. They can't just declare on the spot that your data is now their data.
Since 4th ammendemnt protections are significantly curtailed at border crossings, they can actually declare on the spot that your data is now their data. The only thing they can't do is force you to tell them how to access it - but, if they can hack your password, they actually have the right to search your phone just as much as they have the right to search you luggage.
The only consideration then is that they can't force you to help them access it. The fact that it's your data is irrelevant. This matters a lot if, for example, you have a copy of your password written down with you - as they are very much allowed to use that to acces your phone. Or, even more plausibly, if your phone is protected only by a biometrics, in which case they can compel you to provide those biometrics and access the phone that way.