The 99% use case for having to unlock a phone with TouchID / FaceID / 4 digit passcode is to prevent people from snooping on your phone (think children, coworke

The 99% use case for having to unlock a phone with TouchID / FaceID / 4 digit passcode is to prevent people from snooping on your phone (think children, coworkers, strangers, thiefs) within a relatively short period of time. If your phone is stolen, for example, you'll probably contact Apple and remotely disable it within a day, probably sooner. I don't think TouchID / FaceID / 4 digits are intended for the 1% use case: preventing malicious actors with long term access to the phone from getting in (think police, government agents, etc.). As a result, most people I see have 4 digit codes on their phones, without the "10 wrong passwords erases all phone data" option enabled. That alone is probably more insecure than FaceID / TouchID over the short term. Sure, a 3D map of your face or your fingerprint is not a true password.. but for this use case, they're a perfectly fine substitute while being more convenient. If you want long term protection, then you should use an alphanumeric password for your phone with the "10 wrong passwords" option enabled. But most people don't want or need that.