On: Identifying backdoors, attack points, and surveillance mechanisms in iOS devices

[dunham]

Yes, the device needs to be unlocked to pair it, otherwise it doesn't access to the keys needed to create the pairing record. The pairing record (stored on your desktop) helps avoid needing to unlock the device for subsequent access.

I believe the device still needs an AfterFirstUnlock key to decrypt the escrow keys, so a cold-booted device wouldn't be accessible even if it was paired.