Apple's implementation makes this incredibly difficult given the 10-attempt failsafe (wipes device) and increasing timeouts for failed login ("try again in 1 hr" - after 7th failed attempt).
Also even given a trivial passcode, if you use "complex passcode" and the same 4-character passcode, you've vastly increase the key search space with a minor change to usability (esp. if you have touchID).
I don't like the 10-attempt-auto-wipe because it also gives someone an easy way to erase your device -- which I think is just as likely as a scenario. For example if you recorded the police and they didn't like it...
Having the password (in your mind and on your fingers) and the "sensitive information" ;- having them together in the same place at the same time is just asking for it really.
Isn't it standard to do all decryption attempts on a clone of the phone rather than the phone itself? After ten attempts, just reset the copy and try again.
The researcher does recommend never surrendering your phone unlocked however - that guarantees someone can just hook it up to a USB connection, and tap "trust", and then proceed to pull all your personal info and credentials out.
As we saw with the celebrity nude leaks, backups are often easier to acquire and trivial to crack using software like EPPB. Just take a look though Elcomsoft's product list if you're questioning whether you should upgrade to a stronger passcode.
The failsafe/wipe and timeouts are all implemented in software, and are still in Apple's control. They would be able to easily remove those restrictions without you needing to give up anything.
"The failsafe/wipe and timeouts are all implemented in software"
So is unlocking your phone, changing your password, decrypting your phone, etc. How is it easy for them to disable the failsafe wipe if they can't decrypt your phone (and presumable the settings file where that option is stored)?
You can encrypt the flash content, which puts you down to memory, something that is pretty hard to do when it's embedded inside the CPU SoC. If the baseband & other co-processors are not trusted with full DMA access to the CPU ram, then it's practically impossible.
Also even given a trivial passcode, if you use "complex passcode" and the same 4-character passcode, you've vastly increase the key search space with a minor change to usability (esp. if you have touchID).