Yeah, it's fair to say the unlock passcode on your phone is more vulnerable than a specific authentication password used during a web login. But other than length and how frequently it's exposed, it's not fundamentally different from shoulder-surfing that password and then stealing your keyfob. In both cases you can try to deactivate the account before the next login.

Biometrics are probably the best way to prove identity and control of your phone, locally. They already have a high-quality CCD. Biometrics are unpopular as something sent to remote devices for a variety of reasons, but should be much more palatable if they remain local-only.