Only if it’s running, if it’s off you need some way to fetch data you’re not supposed to be able to fetch and then brute force the key which is supposed to use very large amounts of cpu power. A flaw in the security chip would allow you to use the secret data and run the calculation on the chip, but that severely limits the amount of calculations you can do.

This may very well be limited to phones which have short numeric passcodes.