just based on having seen data recovered from other flash devices, and the advertising copy of these devices:
hot-air rework to lift all the flash chips off and get them hooked up to something (probably custom) that can read them.
if the controller was encrypting everything that went to flash, you also get to try and find the key in the controller's memory.