GrapheneOS phone locks and I use longer pass phrase. You only get so many tries to unlock. So they would have to grab unlocked phone out of my hand. Even on a desktop you don't generally have even a separate password for every app but less hardware auth. But face ID or even fingerprint I think are bad idea. Among other things in many places you can be forced to unlock using them. Even if you are unconscious.