Pretty sure you can upgrade the OS on a locked phone if you have physical access to it.
The backup is probably easier to attack if you have it, since it doesn't have hardware imposed timeouts on password guesses. It may not be current however.
Nothing's bulletproof but the iPhone is the most trustworthy IMHO.