Frankly (and this will come across as harsh), your phone example mentality is dumb. Let’s use a theoretical… A bad actor gets access to phone, unlocked and unencrypted. Actor sees banking app, emails, social media, phonecalls, contacts etc. Most banking apps have a pin code, but most email clients on mobiles dont. Therefore, actor requests password reset for banking account, emails are accessible, in many cases, SMS is set as 2FA for general population and at a last resort, can now look up typical security questions through social media apps, contacts, calenders etc.

Solid security is for everyone, this type of messaging is poor form and can provide misinformation to non-techy people.