Someone else here mentioned that the the reddit comments (now deleted) said that the phone had no passcode on it, so anyone would be able to unlock it.
Ah, that's it then. I figured they would likely have a passcode, since the "someone steals my phone on public transport" threat vector is a pretty obvious one even for non-tech users. Unfortunately the thread got nuked before I got to read it more...