I just use a real password to unlock the phone, not some lazy 4 digit pin. Yeah, it's a pain on the rare occasion I have to type it, but it's worth it.

If I'm in any sort of situation, I disable facetime by pressing the power button 5 times quickly. This means the next unlock requires the full password. I also have the phone set to erase itself after 10 failed attempts at this password. I can also erase it remotely with findmy.

And I never, under any circumstances, let anyone other than myself touch my phone, or any of my computing devices, while they are unlocked. Ever. No exceptions. Even in an emergency situation the people I trust most have no reason to access one of my devices while unlocked. None.

Someone might steal my phone, but they won't get anything beyond the device itself.