Grayshift claims that USB restricted mode does not make a difference, so how do people protect against Grayshift?
The problem with Apple's USB Restricted implementation (currently) is that it is triggered by the plugging/unplugging of something into the Lightning port. So, for example, if you catch a device within the 1 hour window before the mode enables (and locks you out), you can unplug the cable and plug it back in before the end of the countdown happens and you now have a whole other hour to work with. Repeat this for unlimited attempts, just like before the feature was added. So, the viable workaround would be to just add a function to perform an unplug/plug action every 59 minutes or so, to gain another hour of brute-force attempts.
That is POSSIBLY how Grayshift worked around the problem as it is very easy to implement.
Apple's already aware of this issue and are probably working on changing the behavior to make the timer only reset if the device is unlocked again rather than by unplugging the cable before the countdown has finished.