They have to reboot it to use a bootloader exploit. Reboot it again after you get it back to erase whatever they did.

I realized they might have added a fake reboot menu. So either use the exploit yourself to check it's the real bootloader (no realistic chance the FBI made a fake bootloader exploit in the fake reboot menu) or let the battery run out or remove it.

Nobody is going to add a fake reboot menu

Or they wouldn’t have, until they saw this thread, just for the sport

All Apple mobile devices I've used have had some form of low-level forced reboot method, akin to holding down your PC's power button. Though I can't say whether it's also something one could subvert with a BootROM exploit.

https://support.apple.com/guide/iphone/force-restart-iphone-...

seems like a huge amount of effort when they could simply give you a bugged phone of the same model that automatically transmits the passcode to them when you enter it. Newest ios are usually vulnerable to Cellebrite anyways.