Another way?
They cloned the phone and disabled the 10 failed attempts self destruction feature. Thus able to try all of the combinations?
Pretty much. 10,000 possible passcodes. Clone the device, short out the hardware counter (very much a not-trivial task), then tediously enter all possible codes until one works. Trying one code per minute (assuming complications & documentation), 16 hours a day (two shifts), would take no more than 10 days and an average of 5 (right around how long it actually took). I expect the company already had a timeout-disabled device ready for cloning before the FBI actually hired on, so setup may have been just 1 day once the suspect’s phone was handed over.