“Our results show that when an fTPM’s internal state is compromised, a TPM and PIN strategy for FDE is less secure than TPM-less protection with a reasonable passphrase.”
Windows 11 made TPM 2.0 mandatory, and most machines meet that with a firmware TPM running inside the AMD Secure Processor. Break that processor and every key the fTPM holds comes out, PINs and anti-hammering included. BitLocker’s TPM-only mode falls to 2-3 hours of physical access. Microsoft made the TPM a hardware requirement in the name of security, and a plain passphrase beats it.