If a profile is in After First Unlock, the data isn't at rest and a sophisticated threat could use an exploit to bypass the lock screen. If that capability is not available, which can be a case with new devices, then brute forcing is a fallback. An AFU brute force can also be much faster.
For devices that are Before First Unlock they always require a brute force because data is at rest and must be decrypted to be accessible. A secure high-entropy passphrase would be impossible to brute force regardless of device, although having to type in such a long, complex password would be tedious for some.
We recommend GrapheneOS users with forensic extraction of a seized device as a major threat to do this to ensure data is safe BFU regardless of how long the device hasn't been updated for.