Comment by nealyoung

There was an article on here about that a few months back. The main idea is that the passcode entry limit is enforced by the OS, so Apple is able to sign and use a custom OS that doesn't enforce the limit, then brute force the passcode from there.