Is there any reason to suspect that Mr. Crooks had both a non-trivial password, and a model of phone with no physical_access => root weaknesses? My impression so far is that he was a very young, low-skill, and probably impulsive - all of which correlate with swiss cheese infosec.
No reasonable person should trust the security of an iPhone or Android when it comes to state actors. These devices likely offer sufficient protection against common theft, but they are vulnerable to sophisticated attacks from government entities.
Both Android and iOS are full of backdoors.
How do you think NGO make their living ?
Typed in 4 zeros for the password or borrowed his finger.
Probably something like this:
https://en.wikipedia.org/wiki/Grayshift
https://en.wikipedia.org/wiki/Cellebrite