IIRC from the San Bernardino case, that was the case on the shooter's phone (a 5S I think), but since then it has been built in to the "Secure Enclave" chip which is not affected by the vulnerability. But you could flash a fake iOS that logged the user's code and/or directly exfiltrated the data--the user would have no idea that it was not the stock iOS they were giving their code to. It would leave them which a bricked device the next time they rebooted, which could raise suspicions.

It was a 5c; 5s and later had the SEP.

You don't 'flash' a fake ios; you can use the bootrom exploit to put your modified version of ios into memory, and once you reboot you would get back straight stock ios. They could even make it reboot as soon as the password was harvested, leaving behind no trace. This is scary stuff. You can keep yourself safe by rebooting as soon as you get your phone back from border patrol, but many people would not know to do that.

It doesn't. Just reboot the phone and it's secure.

I think you misunderstood the threat model. The concern is that they seized your phone, used the exploit to bypass the "normal" passcode protections, allowing them to bruteforce your 6 digit passcode in hours/days rather than years/decades/never (if you had the wipe after 10 failed attempts enabled).

That is not possible, the key is inside a hardware chip which enforces the number of tries for the PIN.

Now they do. That wasn't always the case though, for those on older devices (Anything older than the 5s, I believe), or older iOS versions.

You can use a numeric sequence passphrase as your passcode; there is no 6 digit limitation; I have a > 6 numeric passcode/passphrase.

You can also use an alphanumeric sequence.

Don't use a 6-digit passcode.