I used to jokingly take my brother's phone and attempt to guess his pin, always getting it right in a moment or two before quickly looking up silly search queries to ruin his search suggestions and targeted ads (e.g 'pullups' and 'homeopathic resurrection'), creating some fun shenanigans.
Recently, he handed me his Iphone, with a newly setup touch ID. He offered me $50 if I could crack it. While holding the phone up, I walked away while pretending to look at it, thus capturing his face with the phone over my shoulder, turning it on. I continued ruining his search recommendations while pretending to guess the password.
Thieves like this would *love* if they had face ID, as it simplifies the job greatly from trying to memorize a password over someone's shoulder, to briefly flashing the screen at them, only for a second, while using clever social engineering to make the action elusive.
Touch ID is technically the most secure against this kind of attack, as it requires the user to press their finger on the phone for a moment. A good grifter could still manage to pull off the classic 'I need to call my mom but my phone is dead', of course.