help to understand if I am wrong but an attacker has to:

- Find the device unlocked or know the pin

- Get physical access

- Play with the mobile device for a couple of minutes while waiting for a message ?

If I am not wrong, what are the chances ?