However if you have signing keys and access to the update delivery infra you could just publish the update and wait for it to get auto updated before starting to seize the phones.

To my knowledge this is true for normal android as well (perhaps not that authentication is required); the data is encrypted against the passcode.

But the phones were also under some form of MDM, maybe they could have used that?