Hardware tools like the "PLC Unlocker 200 SMART" or "S7 Unlock Key" (sold on Alibaba or automation forums) work by exploiting the STM32F1 microcontroller that Siemens used under the hood.
S7 200 Smart - Forget password - Minimum Privilege - SiePortal s7-200 smart password unlock