Even if there is a passphrase, this would likely allow for brute-forcing it.
No, you'll still have the TPM's dictionary attack lockout.
I thought that was usually enforced in the OS, and that this was a big reason why you need secure boot. To ensure that you cannot boot an OS that will allow a brute force.
Certainly this was the case with the iPhone when the FBI asked apple to write some custom firmware for them.