If a thief grabs a phone from someone’s hand while authenticated, can’t they then just make it theirs by immediately resetting the password pin and Face ID?