What stops someone from attacking the system outside of the operating system? Or (at the very 'worst'), simply taking a copy of the storage and reloading the image onto the original device repeatedly?
On a PC, attacking outside the operating system is dead easy when you have physical access. All you need to do is boot from a CD or USB drive. If the BIOS has been configured not to allow that, you can take the hard disk out and plug in onto another machine.
Mobile phones and tablets doesn't allow booting from anything but the internal flash memory. When you power on the device, it boots into the operating system and doesn't respond to anything before the user has passed the login screen. (There are a few exceptions, such as Google's reference phones intended for development — and even for these the default bootloader lets you install an alternate boot image but wipes the device first.) So barring a bug in the bootloader or in the operating system, it is impossible to reach outside the operating system.
Bugs of course do happen. Apple's devices get jailbroken sooner or later, but these days it gets more and more difficult, with exploits getting very complex. Microsoft's Surface tablet hasn't been fully rooted yet. Android phones are rootable as a rule, but then Android wasn't particularly designed to prevent that (Android doesn't treat the user as hostile).
Physical access to the flash memory is of course possible, but the flash chip is soldered to the main board. Depending on the model, it may be that all you need to access it is some affordable electronic equipment (basically, the right kind of connector) and careful aligning of pins, or you may need to unsolder the flash chip from the main board. The latter case pretty much kills the resale value of the device, and even the former is beyond what your average thief is prepared to do.
Nonetheless, with physical access, a targeted attack can extract your data. As a rule of thumb, you should not store secrets on a mobile device that are worth more than about the resale value of the device. Your Facebook account isn't worth that much, but your company's financial data may be. And if your phone is seized in a police raid, this is routine for a forensics labs.
It's my understanding that even having Bitlocker on a Windows system wouldn't protect against the latter... or am I wrong and there is something clever with the TPM chip going on?
A TPM adds another layer of protection. It is a tamper-resistant chip: without some expensive equipment and the knowledge to use it, you cannot extract its internal memory (and you will probably render the chip unusable in the process). (There are also ARM-based platforms with a TPM that isn't a separate chip, but implemented as firmware in a system-on-chip. There also, physically extracting the keys involves dissolving part of the chip.)
With a (properly-used) TPM, the TPM chip contains a hash of the boot image. If you manage to reflash the device, the bootloader in ROM will complain that the boot image is bad and refuse to boot. The TPM may also be used to encrypt data on the device, again with a key that is stored in a tamper-resistant chip.
A 4-digit PIN, even if chosen at random (as opposed to
1234 or the owner's birthday), falls under 5000 attempts on average. There are a few more possible patterns, but they are very vulnerable to exposure through finger traces. This protects against a drive-by attacker who tries a couple of codes while the owner is looking elsewhere, but not against a patient and unhurried attacker. Credit cards store the number of failed attempts in their persistent memory: three strikes, and the card becomes unusable. Such extreme behavior is considered bad for most devices, especially a smartphone which may be used while in motion. So the protections tend to be more lenient, and in particular as far as I know rebooting the phone resets the counter on all major operating systems, so that an unhurried, equipped attacker can keep rebooting and attempting different PINs for hours until he finds the right one.