> Let's suppose I have done the most I can to secure my phone on a software level (e.g. encrypted storage, restricted app permissions ... whatever you consider "maximally secure"). Is physical access still game over?

It is very trendy to say "everything can be hacked", but in your case **the game is not over**. Mobile OS enables much more security hardenings than PC:

1. Secure OS (see [ARM TrustZone][1]).
2. Specialized security chips (see [Secure Enclave][2]).
3. SELinux.
4. No root.
5. Containerization.
6. Disk encryption.
7. ASLR, KASLR.
8. and much more...

*And this is a baseline for iOS and Android in 2020.*

Let's consider the basic way how data is protected in a modern mobile OS:

1. You set a password
2. Password -> symmetric key 
3. Key -> encrypted storage

Considering *you have done the most you can to secure your phone*, there are 2 options to access your phone:

1. **brute-force your password** (a guessed password means an access to your data)
2. **do a factory reset** (you loose data, but data remains confidential)

---
**Real world example**

There are "magic tools" like dr.fone which claims to unlock any phone [without a data loss][3]. Now take a look at their [guide with an iPhone 7 case][4]:

> Please note this unlocking process will also **wipe the data on your** iPhone/iPad. Honestly there is no solution to bypass iPhone/iPad lock screen without data loss for the moment in the market.

---

Let's say, if operating system doesn't save your password on disk as a plain text, and your mobile device has been rebooted (so keys don't stay in memory): your data is safe. It means that **offline attack** is almost impossible. (I said "almost" but it also means the game is not over yet).

Therefore to be sure about **data confidentiality**, be sure you do your best:

1. Choose a difficult password/PIN
2. Don't forget to lock your device with any kind of credentials

And yes, theoretically there is no absolute security: OS may just not encrypt files, or it may leak encryption keys, even cryptography is based on a relative difficulty to solve a particular mathematical problem, or on difficulty to attack a particular cipher... But the game is not over.


  [1]: https://developer.arm.com/ip-products/security-ip/trustzone
  [2]: https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/web
  [3]: https://drfone.wondershare.com/iphone-unlock.html
  [4]: https://drfone.wondershare.com/guide/ios-unlock.html