Every other exploit chain that the likes of Cellebrite use to pry the user data encryption keys out of TZ starts in some shitty DRM module.
source?
source?