At least on my Sony/Android phone it's possible to access a subset of the camera app from the lock screen (phone locked). No fingerprint reader, and the "pin" is a passphrase.

The phone is encrypted - but the battery isn't removable, and I assume there's more than one way to get at the data as long as the phone stays on (usb/pin header access, some form of cold boot attack, kernel 0day).

I seem to recall the iPhone used to be similar wrt using the camera on a locked device - you can disable the touch id and enable a more secure pin? (although, if it's still possible to brute force the hsm, going to a "secure" number of digits isn't really practical. But six digits with three attempts before actually hardware enforced cool down should help a bit. But even at just 1 guesses / 3 seconds on average, it'd at worst take a month (15 days on average) to get into such a device, assuming an automated/robot brute force toolkit - especially with faulty tamper resistant hw).