Having a PIN is much more secure, as bandits can't use your appendages to get into your phone. I really don't get why people jumped on the bio-metrics bandwagon so quickly. If my Password or PIN gets compromised I can change it. if your fingerprint, or iris gets cloned there's nothing you can do.
Bio-metric security looks cool in movies, but in real life it's an utterly pointless less-secure gimmick.
Seriously though.. Fast Forward 20 years and the Social Media platform that everyone uses has just 'accidentally' leaked 1bn users bio-metric data to a 3rd party. Good luck re-securing your identity after that.
My point is still valid, you can't change your eyeballs, fingers or face if your bio-metrics get leaked.
If someone malicious has access to me while I'm sleeping I have far greater problems than whatever's on my phone. Same goes for muggers: if I feel threatened I'll happily give my pin away because my integrity is far more important to me than whatever data is on my or my company's device.
If my face fingerprint get cloned the baddies will still need physical access to my phone, which takes us back to my first point: the data in my phone is worth nothing compared to the worth of my physical integrity so it's irrelevant.