Physical access required. For an iPhone user this could be useful. For someone that loses their phone, bad.
Or even leaves the phone unattended for 2-3 minutes at a business meeting...