As far as I know, the only way they can do it is if the phone is in the After First Unlock (AFU) state, that is, when you have restarted your phone and have entered your password. If the phone is in the Before First Unlock (BFU) state, that is, before you have unlocked your phone after a restart, they can't get any data because it's all encrypted. Once you have unlocked your phone after restarting, all data is decrypted and can be accessed without knowing the phone's passcode. Therefore, the best defence would be to use the automatic reboot (Settings -> Security -> Auto reboot) feature. The phone will reboot if it hasn't been unlocked (with either the passcode or fingerprint) within the selected number of hours.
The other thing you can do is to only allow new USB accessories (Settings -> Security -> USB accessories) when the phone is unlocked or to deny new USB accessories altogether. However, I believe if a USB accessory is in the phone and is restarted it will ignore the selected option (at least from what I have heard).