i'd say that the amount of ppl that have this "delete data after 10 failures" feature enabled is vanishingly small, hence every passcode can be bruteforced