To end this discussion.
In BFU the data isn't accessible if you have a very strong password. 128 bit of random entropy.
In AFU mode nobody knows what company will pull out some sort of magic.
So if you want to be really secure against forensic use the phone only when you are sure that YOU will have the possibility to reboot it yourself. Where and how to pull it off like this is up to you. Simple as that