You are the first person in the thread that I thought was a good place to reply. I wanted to post something that I just realized, and haven't seen anyone else post, or write.
If Apple were to build an iOS version that did this, it would work -- for the iPhone 5C and earlier. Or to state it another way, an iPhone or iPad with the A6 processor, and earlier. It wouldn't work (in a reasonable time) for an iDevice with an A7 (or later) processor.
The reason? The A7 introduced the Secure Enclave. Earlier versions had some of its features, but the Secure Enclave has an extremely important feature, with respect to this issue:
To further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode at the Lock screen. If Settings > Touch ID & Passcode > Erase Data is turned on, the device will automatically wipe after 10 consecutive incorrect attempts to enter the passcode. This setting is also available as an administrative policy through mobile device management (MDM) and Exchange ActiveSync, and can be set to a lower threshold.
On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period.
This is from:
https://www.apple.com/business/docs/iOS_Security_Guide.pdf
The delay escalates to 1 hour after 9 attempts. So, it would take over a year to exhaustively search the entire keyspace,
of a 4-digit passcode. Of course, I'd check the common passcodes first (1111, 1234, etc.).
My point: a backdoor'ed iOS would only be useful for older iDevices. An relatively recent one would still be effectively secure,
especially with a complex passcode.