Yes, CBSA officers can legally do that. A citizen has the option of entering or leaving Canada without the phone while CBSA attempts to crack the pin.Edit: getting pushback I see. Here: r/canada - IAmA former BSO for the Canada Border Services Agency, AMaA!