They’re not, but if someone does use the same passcode, it could open up a vulnerability. That said, using the same passcode would defeat the purpose for what

They’re not, but if someone does use the same passcode, it could open up a vulnerability. That said, using the same passcode would defeat the purpose for what I believe is the primary use case (I want to loan you my device, so I have to give you the unlock passcode, but I don’t want to give you unfettered access). So I really think having the passcodes match is an edge case. I can see it happening in other use cases, though (e.g. kiosks).