Even without TouchID, iirc on previous iPhone models entering an invalid password 10 times would trigger a wipe. So not a new threat -- just balancing maintaining the confidentiality of your data with the DOS risk.