Not that this fully addresses point #5, but automated mechanical means to enter the PIN do exist: http://www.blackhat.com/us-13/arsenal.html#Engler

As gpm pointed out in a sibling comment, the issue is that they can't brute force the PIN without wiping the phone.