This may come as a shock to many who use 2FA and have 15 digit passcodes like me, but a lot of people don't have any sort of lock on their phones.