I think it would be pretty easy to get many people's phone password -- just by being in the right place when they unlock it, and watching closely. Most people I know don't cover up their phone at all when they enter it, even in public.

So you don't need to get "in someone's head". You just need a good view of them using it.

Granted, getting an iTunes Store password by just watching would be a lot harder. But compared to the 4-digit lock screen pw (or even the Android shape pw) TouchID seems a bit more secure, at least to me.