“However this 5 guesses limit is enforced completely within the client’s logic: it relies on the attacker using the official Bitwarden client.”
Bitwarden lets you unlock your vault with a PIN and stops you after five wrong tries. The limit lives in the client, so anyone holding the vault file skips it and tests all 10,000 four-digit PINs in under four seconds. Bitwarden marked the report out of scope as an attack needing physical access. Surviving physical access is the whole reason to encrypt a vault on disk.