We don't have much information about what Pixels currently do in the final TEE phase of key derivation. What they do there is important because that's what provides the work factor which is meant to be impossible to offload to a server farm. The OS uses scrypt which can be offloaded to a server farm, so it's up to the TEE to use hardware-bound key derivation where a TEE exploit can't obtain what's needed to offload it. The TEE does not implement the time-based throttling but rather the secure element does that. Android's secure element is different than the iOS one too. It's a separately manufactured chip with authenticated encryption between it and the main SoC via pairing at the factory. iOS uses a separate processor on the same SoC. iOS approach provides lower latency and higher throughput, but it can't be manufactured substantially differently. The Pixel approach means they can theoretically defend better against physical attacks, but we don't have details on what they're doing to defend against those attacks since it's not at all public and has nearly zero public research about it, unlike firmware security research where there's some information available.