That’s also why I have advanced protection turned on. Granted they could always get the encrypted blob and try to crack it at that point, but there has to be some point you’re willing to draw the line.

I would fully expect any cloud provider to do the same given a warrant, but I've heard some will provide data simply because it was requested.

And this is why encrypted backups should become the norm. Sure, they could always try to crack the encrypted file after it gets turned over, but (assuming you have a good password set for your account) we’re talking about a scale somewhere between “a few billion years” and “the heat death of the universe” with conventional (non quantum) computers.

PIN bruteforcing.

Curious, how does that work? 10000 possibilities aren't many but you get 30s break every 3 failed attempts then 5 more then its every single failed attempts so that'd be ~5000minutes so that's about 3 days. Assuming they get "lucky" it's about 1.5 day. I don't know though what happens after 20 failed attempts, maybe it's 1min break or 20min break.

Basically, does PIN bruteforcing actually work and if so on what timeframe?

As an added benefit, that protects you if your phone gets lost or stolen during the journey.

The few times I've traveled internationally I just bought a cheap unlocked burner phone. No telling what you might catch in another country. Plus it's just basic itsec.