It is a hack. It shouldn't be possible to test pins via a lightning connection. If it weren't exploiting a bug you would have to enter the PIN via the screen, and then you only get a few attempts.

It seems likely that Apple could just buy one of these, find the bug and fix it. Unless it is using some very low level exploit which I suppose is possible and might explain why it is hardware rather than software (though that might also be to justify its cost and prevent piracy).