“Forensic companies are rebooting devices in ‘After First Unlock’ state into fastboot mode on Pixels and other devices to exploit vulnerabilities there and then dump memory.”
GrapheneOS found and reported both bugs months ago. Google’s bulletin admits “limited, targeted exploitation.” The ones exploiting were forensic firms unlocking seized phones without the PIN. The fastboot fix zeroes memory before USB comes up. The factory reset fix is partial, since cutting power still stops the wipe.