My screen timeout is a minute, so they likely can’t get very far before bumping the side button or just not babysitting it for 60 seconds and needing a long password or fingerprint. Any app worth looking at needs a fingerprint as well, so even if unlocked, not super valuable short of a highly coordinated, personally targeted attack. In which case Pegasus would be easier and faster.

Plus, I always “pull over” and hold my phone with two hands when in a busy public place.