How to decrypt user data on Android / LineageOS via bootloader / TWRP / adb?

Phone: Google Pixel 3a XL
OS: Lineage
Goal: Retrieve personal data like photos
Problems: Forgot password pattern; user data encrypted

I forgot the password pattern to my Google Pixel 3a XL and want to get my photos out before doing a factory reset.

What I've done already:

1. Entered Recovery Mode
2. Enabled ADB and connected Phone to Laptop (Arch Linux (Manajaro))
3. Flashed TWRP image onto phone:adb reboot boatloader, fastboot boot twrp.img
4. With TWRP UI on phone, I deleted a db file related to passwords in folder data/system/
5. Also accidentally deleted device_policies.xml, but created a new device_policies.xml and pushed it via adb
6. Booted OS/Lineage normally
7. Wasn't asked for a password anymore, but on display, it was saying "Smartphone is starting...", but nothing happened*
8. I was still able to swipe from top downwards, connected to WiFi, opened the settings, enabled USB debugging, and set a new password (this time 4 digits)
9. Repeated 1.-3., created backup with TWRP, did some other things with TWRP that I don't recall anymore (did not delete any more files though;)
10. Booted OS/Lineage normally again
11. Tried to decrypt the phone via settings, but the option seemed disabled
12. Repeated 1.-3.
13. Tried to decrypt data via TWRP - was asked for a password but the one I created before (see step 8) wasn't accepted
14. Tried to pull data via adb but no permission (I'm SU, rooted)
15. Now trying to boot OS normally fails - infinite Lineage logo animation

What I would like to achieve:

I only care about retrieving my personal data from the main user profile of that phone - i.e. the photos.The problem is that neither can I pull data via adb nor decrypt the data via TWRP.

What options do I have left now? Please help - and keep in mind that I'm a complete noobie.

Could I somehow get the whole (relevant) partition out of the phone onto my laptop and then maybe try to decrypt the data using some brute force tool?Or is there maybe an easier way to get the data?

*) Update: Don't know if the "Smartphone is starting..." message is related to the previously taken steps, since it only appeared after swiping to open the screen - which wasn't possible before due to the password protection which I bypassed by deleting that file (see 8.)