They can sign their own alternate ramdisks, and the default PIN is only 4 digits, so that's not surprising really. It's been possible to load similar forensic software on A4 devices by anybody for years now.
The wipe after 10 attempts is moot anyway, we are talking about Apple loading new software into a ramdisk and brute forcing it. I've personally done this at an owners request.
A normal user could do it on any device with the A4 chip or prior, vulnerable to the limera1n exploit. Apple could do it with any device, as they own the signing keys for the bootloader.
