They do some monkey business with sgx to make brute forcing harder but yeah it's worrisome.

https://blog.cryptographyengineering.com/2020/07/10/a-few-th...

https://signal.org/blog/secure-value-recovery/