I too am incredulous of that claim. Most likely it was meant to scare the uninformed (and also the informed, since they do not want to waste the time).

Depends on when it happened. There have been times when there have been workable exploits that have been used by law enforcement agencies.

There's a fairly high-profile Israeli company that specializes in finding or buying zero-day exploits and reselling them in script-kiddie form to law enforcement agencies at high prices.

I wonder if random power tripping border security goons get to use zero day exploits just for kicks?

The exploits come in a nice box (physical box with phone connectors), and sadly, the answer could be yes at the bigger checkpoints (depends on whether they shelled out $$$ for the box).

Odays often have a finite lifetime. Once you have bought an exploit you may as well use it. Cellebrite and Greycode produce reliable and surprisingly functional gear. Apple and other vendors obviously try to discover what exploit is being used, and exploit vendors try to hide the technique. I suspect this is why sometimes the device is never returned.

Generally I wouldn't characterise the customs people as goons. Like most LE jobs they see some nasty stuff. I'm talking paedophilia and violent pornography. They also deal with some really sketchy characters and if you trigger that detection you are definitely getting extra scrutiny.

It'll be built into the forensic analysis software they're using.