You do not have to give them your pin, by law. They can use biometrics to open your device, which is why you should not use biometrics for device unlocking.

GraphenOS has a couple of settings, a distress pin that wipes the device, and a number of failed attempts that will wipe the device. If the person handed over their "pin", they didn't need to

GrapheneOS does not offer a feature to wipe the device based on failed attempts.