GrapheneLover "lock screen bypass because it never got to the point of the lockscreen"
This also applys to the BFU state.
Imagine you are a WWII solider, I give you the battle plan in a note encrypted with the enigma machine. The note however i stored inside of a locked box.
The only way to read the battle plan is to use your key (for GOS/android that would be the random 256 bit AES key stored in the Titan) with the note. But in order to get the note you need to open the box with another key.
Now imagine that same scenario, but instead of the note being stored in a box, its just handed to you. You still can't read it without using the key in the engima machine, but its not locked in the box.
This is a loose analogy, it may be more accurate to say in full disk encryption that the note itself is in plaintext inside the locked box but I think that would have some concepts lost in translation. Regardless, the pin screen what 'unlocks' the data, its an input for the Titan chip. That Titan chip then releases the AES key based on if its correct or not (based on its own calculation in chip away from the CPU) to the operating system so it can actually decrypt the data.
If a pincode bypass was found and done on a device in BFU it would fail to start because the operating system doesn't have the AES key from the Titan chip.
This is why wiping takes less than a few seconds on Pixel devices. The data isn't destroyed, the key is. NIST considers this as secure as deleting the data itself.