That's why I get that the default should be a passcode. Same reason Windows Update probably should automatically update. We live in a problematic world and these options are the least bad.
My Grandma's solution to this problem is to not bring her phone with her when going to public places, and that's probably the right call if you can swing it.
It's one thing to be a default. It's another thing entirely to employ dark patterns and annoyances to coerce/trick the user into doing something they don't want to. The user should ultimately be in charge, and the machine should get out of the user's way.
My Grandma's solution to this problem is to not bring her phone with her when going to public places, and that's probably the right call if you can swing it.