TFA actually gives some social engineering examples, like using someone's phone to take a photo or look at a photo, then turning the phone off before handing it back. That triggers a password prompt when the phone is turned on again. Some thieves even use hidden cameras to observe password entry.

Guess it's time to tell my kids never to type their password in public!