If you are using fingerprint or faceID, then they do not even have to use this tool.
It is still a 24h block (let's use the default) where the device is vulnerable. In many countries there are no protections against pressing your finger on the phone, or worse yet, turning it to face you.
It also disables biometric unlocking until the password is entered.