Unlocking boot loader **doesn't** wipe data. How is it a security threat? MiA1 is probably the only one of it's kind that doesn't wipe data when bootloader is unlocked (tested by me and widely known)

It is said to be a security threat. I am not clear how

Say my device is stolen and one wants to access data how does this feature make it easier given 


I use 6 digit PIN and fingerprint. One has to get past that before adb can be activated and  used to transfer data to a PC. 
The device is encrypted (Oreo 8.0.0)
Debugging turned off


(I am not  talking of risks of unlocked boot loader. I understand that)

This is not a hypothetical question but something I need to understand, this being my daily use device. 

I don't have information that calls for three letter agencies to use sophisticated tools , so that angle can be ruled out while answering (though useful to know). 

I am looking for realistic threat assessment
Using twrp decrypt password one can easily write a simple brute force script to guess your password. And as I can see it, there isn't any limit on how many times this command can be executed, so depending on the strength of your password, your device will be unlocked one day or the other. 

Having debugging turned off doesn't make any difference in TWRP