If you set up a device to explode once someone enters a room, it doesn't matter who set it off by entering the room if they had no idea the room would blow up.

I don't think it'll be very easy to get out of liability in this case. The duress PIN is a feature explicitly designed to delete all data when it is entered, especially in cases of coercion like this. There would be more plausible deniability if officers had simply discovered it somewhere and tried it on their own, but in this case it was knowingly provided directly in place of the real PIN.