They can hold you indefinitely for effectively whatever reason they'd like (or really no reason).
If they say they're not letting you go until you unlock your phone, you get to decide if you want to stay there in the interests of your privacy.
If they say they're not letting you go until you unlock your phone, you get to decide if you want to stay there in the interests of your privacy.
The author is arguing that they wouldn't know the usernames or even the services themselves of your accounts and as such could not ask for them. I call bullshit on that (see my top level comment on this).
Or, taken a little further, I don't even know my email password anyways. Its locked in a password manager which requires 2FA. I would myself be locked out of almost all of my accounts if I didn't bring my phone.
But this also raises the question of them believing me that I can't login because I don't know my password.