Brute Force Attack + Diceware Owner + Random PIN User

I have a question about a bruteforce attack via the security element.

When we read the FAQ, we understand that each profile has its own encryption key:

https://grapheneos.org/faq#encryption
https://discuss.grapheneos.org/d/4049-security-from-bruteforce/66

Now, could an attacker directly try to decrypt a user profile, without decrypting the owner profile?

On my Owner profile, I use a diceware password to have enough entropy.

On my user profile, however, I use a 6-digit PIN.
So at this point, if the encryption key is independent of my owner profile, I'm no more protected by having put a huge password in my Owner Profile?

For my user profile, I depend solely on this passage:

Random 6 digit PIN is a baseline where you depend entirely on Weaver for security

ok but technically, to try to unlock the second profile, without having unlocked the owner profile.

So an attacker must directly attack the tensor 2 or tensor 3 chip?
Or is there a way, when the phone is in BFU, via fastboot or recovery, to try to mount the partitions?

In any case, I understand the interest of what GOS is developing for a 2FA to unlock the phone in addition to the fingerprint.