A street mugger don't have the same motivation and means as a government agency. He just want to make some quick and easy buck. He can hit me with the wrench as

A street mugger don't have the same motivation and means as a government agency. He just want to make some quick and easy buck. He can hit me with the wrench as much as he want, if I don't have the recovery code memorized because it's stored safely in my computer at home, he won't get it. He can point a gun at me and demand that we go home to get the code, but that's a different crime, harder and riskier. Most criminals aren't willing to go to that route. The only thing he can get is the 6 digit code that I have memorized because I use it everyday to unlock the phone. That's why this code should have limited capabilities.