Comment by grapheneos

The way he wiped it is legal for the same reason. It was an illegal search and he was under no obligation to preserve the data on his phone.

It's legal to refuse to provide a PIN/password in the US. He's a US citizen so they couldn't refuse him entry. If he wasn't then the result would be getting deported.

It likely would have been a much better decision to refuse to provide the PIN/password and rely on the encryption and device security instead. He could have done a reboot or shutdown in advance but even without that it would have done it automatically via the locked device auto-reboot timer. The secure element only allows 20 attempts for key derivation with rapidly growing delays between those. If he had a strong passphrase then even a secure element exploit wouldn't obtain the data protected by it.