Re: No
The device key is actually stored in the secure enclave, which is essentially a tiny isolated computer on the SoC.
Yes, you're right. And no doubt the counter for the number of failed attempts is stored there also. I wonder if there is some way to trick the SoC into reading the counter as 0 every time, or induce a failure to write to the value.