> And neither android hardware nor the google servers have any kind of secure element enforcing brute force protections

The Titan M chip is present on all Pixel devices:

https://grapheneos.org/faq#encryption