Hence all the scenarios in which an iPhone will fall back on demanding a passcode by design. And Face ID and Touch ID are both optional, and both can be disabled quickly without taking the phone out if your pocket.
For convenience, I use a X character long passcode on my Nexus phone rather than a 2x or 10x passcode. A balance between security and convenience is inevitable at this stage.
Apparently pattern unlock can be easily ascertained by an observant attacker on the other side of a room.
Recent news stories have given us the impression that the FBI find it a major ball ache to access a locked iPhone... I don't know how competing handsets compare. I suspect that if I were a drug lord, I'd be looking at OpSec more holistically, especially with regard to human tendancies to get lazy over time.