> To this they I still can't wrap my head around how can data on an Android phone be considered secure without requiring a long password at boot. Veracrypt style.

it is considered secure only by Google. Android has DOS style security: an app which has access to storage has access to all your files.

> Storing it on a security coprocessor is no good when the entity you want to protect against has most of the world's chipmakers wrapped around their fingers(in the case of US citizens). Software based solutions at least have a change of being verified.