Intruders held a victim’s phone to his face, unlocked it and sold his crypto. Device-unlock should not reach everything you hold.