My guess is that contacts and photos remain in the class of things that do not require the phone unlock key.

Contacts need to be accessed to display a caller's name when the phone is ringing.

Since it's possible to take a photo with the phone locked, the whole photo database may be accessible.

Yes. If you reboot an iOS phone, and then call it without ever entering the passcode before, it will display the phone number but not look it up, because contacts are encrypted. The encryption class here is "locked until first unlock", so they stay unlocked afterwards not to disrupt basic expected user functionality. The whole security design is still much better as many other things stay completely locked.

I stand corrected then. Photos are probably still encrypted under "accessible after first unlock" class. Sigh. Sorry for this mistake.

The idea of having a security architecture with different classes of data still remains, so a third party app can quite easily leverage this, for instance. Unfortunately there doesn't seem to be a comprehensive list of protection classes that each app uses for its files.

Accusations of astroturfing and shillage without evidence are not allowed on HN, so please don't do this here.