The encryption keys are stored in the phone on a ROM of some sort as is the boot pgm. Why doesn’t Apple help the FBI retrieve the keys and prevent power-on from starting that boot program?
There is one AES key encrypting most of the data on the phone. That key is stored in flash but it is encrypted. Some data from ROM forms part of the KEK (key encryption key, also used to decrypt that AES key). Other data needed for the KEK is the hash of the passcode.
To get the needed AES key someone has to enter the correct passcode, then the SW creates the KEK and uses it to decrypt the AES key. If 10 incorrect passcodes are entered the SW deletes the AES key. The user's data stays intact but cannot be decrypted. The FBI wants that numerical restriction eliminated. Second they want an internet or bluetooth interface for guessing the passcode instead of typing it on the screen. That doesn't exist at all. Third they want the AES key deletion turned in addition to turning off the numerical restriction. These are demanded in the court order, not optional.
They also requested the SW to load on the phone although they did not demand it. They said Apple can tailor the SW to work on that one phone only while giving some hand wave about how that would be done. They even suggested using a unique ID assigned by the carrier (Verizon) which can obviously be assigned to any phone they want to compromise in the future (either they are stupid or think we are).