PIN and patterns are secure because the security module enforces rate limits, you can't brute force effectively if every attempt after the first 10 takes a minute. Biometrics can be even better against brute force (more possible combinations) but they are vulnerable to cloning.

With a 6 digit code cracking it will take close to a year on average. With your screen pattern example it's around 100 days. That's more than enough time for the owner to notice and turn on anti theft features. Maybe even for the police to find and return the phone.