keycap_puller
A BFU extraction doesn't mean a typical extraction when the device is BFU, rather it is a special type of extraction to get a limited amount of data available by a device in BFU state. It's a weird misnomer and it could be more specific. If a forensics tool can brute force a device successfully from BFU, then they are performing an Unlocked extraction since they unlocked the device first.
With BFU you're booting into the operating system to decrypt it. A very small footprint of the OS is encrypted by the device and not by a user's own credentials.
A BFU extraction is to extract that particular data. Usually it provides very limited information about the OS and other device-encrypted data like app APKs (user/app data cannot be seen, only that the app is installed on a profile)
As described in the document they have a method of extracting that data for the stock OS, but not GrapheneOS.
https://discuss.grapheneos.org/d/12848-claims-made-by-forensics-companies-their-capabilities-and-how-grapheneos-fares/88
keycap_puller as far as this response goes to the request for sources, it is a rule here that claims be backed up with evidence, this isn't a judgement upon those posting such questions or concerns but for the benefit of less knowledgeable people on the forum and to provide a better knowledgebase within the forum for reference as I have used to respond to you.