My screen timeout is a minute, so they likely can’t get very far before bumping the side button or just not babysitting it for 60 seconds and needing a long password or fingerprint. Any app worth looking at needs a fingerprint as well, so even if unlocked, not super valuable short of a highly coordinated, personally targeted attack. In which case Pegasus would be easier and faster.
Plus, I always “pull over” and hold my phone with two hands when in a busy public place.
It’s the Web 2.0 model of corralling people into walled garden platforms, where they’re driven insane. One day people will look back at this time and wonder what we were thinking.