The before first unlocked state is considered more secure, file/disk encryption keys are in a hardware security module and services aren’t running so there is less surface for an attack . When a phone is taken for evidence, it gets plugged into power and goes in a faraday bag. This keeps the phone in an after first unlock state where the encryption keys are in memory and more services that can be attacked are running to gain access.

It’s more like security theater if the phone doesn’t have the latest OS and doesn’t have the necessary hardware to block cellbrite in the BFU state