Or just turn off the phone. It requires a password on restart or 48h of inactivity.

You can hate biometrics (and I'm still skeptical in general), but Apple did a damned fine job of how they implemented it.