Legally none. Ethically? I think it's worth debating what sort of public trust should be granted to government that sits on an exploit.

But it also requires knowing how they did it. I think most likely they copied the flash, started iterating passcodes, and then reflashed the phone everytime they ran out of attempts. That's sufficiently obvious (to me anyway) that it's not much of an exploit worth documenting and also there's no software fix for such a thing. You'd need to put the passcode attempt counter on some separate piece of hardware that either can't be externally read or reflashed.