I figure a criminal would just rather have you change and disable your password altogether, it takes much less time that way and it's easier to do rather than dealing with carrying around a bloody finger.