Dubbed Pork Explosion, the vulnerability is found in the bootloader of some devices. By sending a specific command, the device can be restarted in a "Factory Test Mode" with elevated privileges and reduced security. In this mode, SELinux is switched from 'enforcing' to 'disabled' and the adb daemon (the on-device service adb talks to) is automatically run as root and doesn't ask for authorization when unknown computers are attached.
Without the above safeguards, it's possible to do quite a bit to an Android device, regardless of the steps a user has taken to protect it. Lockscreens can be bypassed with an ADB command, the bootloader could be unlocked without wiping user data, and with a little bit of time, the encryption keys could be brute forced. Very little is off limits.