Here's how it actually works: when the gov wants to crack your password, like really wants to, and you haven't already saved the pass in system-operated password "vaults" (those can automatically be acquired), they go to Apple or Google and say "record this users keypresses on all devices, and send us their screen activity " and, in short order, all your passwords are known.

Don't think this is the case?

Prove me wrong. Show me in their source code of the OS you're running that they don't do this.

The absence of auditability is evidence for tyranny. Auditability in the case of software is open source software and open source hardware, up and down the entire stack of the device in use. Anything short of that, and you're pwned without even being able to know or prove it -- when it comes to government.