What about the iphone POWER+VOLDOWN thing that flushes the biometric keys and requires the pin?

Looking at the iOS platform security document ([0] page 68), apps use NSFileProtectionCompleteUntilFirstUserAuthentication by default, which keeps keys in memory after the first unlock, regardless of the Power + Volume Down lock. If an app opts into NSFileProtectionComplete, I believe the keys are purged from memory upon locking.

[0] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

More obscure phones might not have support, but that doesn't mean they can't be opened with more effort.

When off, you're relying on the strength of the FDE passphrase and whatever key strengthening they implemented, and that the OS didn't leave some key fragments somewhere (accidentally on flash, which would be very bad, or remanent in memory if it has only been off for a short period).

Using a long alphanumeric (>12 random, >20 passphrase), not installing random apps, keeping it patched and keeping it powered down is probably the best you can do. I wouldn't use the baseband comms if I could avoid it, just a huge 4G attack surface.

Android has a 16 character limit for your password. Or at least it did as of Android 10, not sure if that's changed.

If you root your phone, you can set your FDE passphrase to whatever you want while keeping a usable shorter unlock code. My phone's FDE passphrase is 26 characters long.

Even better, if you have a reasonable worry about losing control of your phone with data that is on there, you should just get a second one that contains nothing sensitive or personally identifiable, uses wifi only, no sim.

This is even good practice if you go to public places where you can get your phone stolen.