Correct. Even with hardware-entangled key stretching, Apple can jack into your phone, disable the 10-entry erase, and then brute-force your passkey. With Android, they don't even need to use the phone. They can just dump the flash storage and attack it on arbitrarily powerful hardware.

You can thankfully enable arbitrarily long numeric or alphanumeric PINs on Android and iOS.