While I disagree with OP, that kind of information isn’t classified. It’s personally identifiable information which is restricted and secured, but it’s not classified in the same sense as the person who leaked on discord.

In response to op, there are plenty of legitimate reasons to classify information that are not nefarious. For example, a diagram explaining the security systems for a building. It’s better to restrict access to that document so it is less likely for an adversary to see the details, because all that would really do is enable them to identify weaknesses which they could exploit. Generally this sort of thing is called operational security and I think it is actually the basis for the US government’s mandatory access control in the first place (e.g. “loose lips sink ships”).

According to reporting, they have actually done this before.

Most of the discussion I’ve read about this is along the lines of: clone the drive on the phone and then brute force the clones (circumventing the lockout issue: if you get locked out just keep trying on a new clone).

In a relatively famous case, the FBI cracked the password on the San Bernardino shooter’s phone, but did not explain how they did it: https://www.vox.com/2016/3/29/11325134/apple-iphone-fbi-san-bernardino-case-ends

Here is a company selling a brute force module for iPhones, although they don’t explain how they get around the lockout issue: https://belkasoft.com/unlocking-ios-devices-with-brute-force

Here is another article about a company that claims to be able to brute force iPhone passcodes: https://www.vice.com/en/article/how-to-brute-force-iphones-graykey/