"not that hard" to whom? A state operator doing a targeted attack, most likely not.

Local police? No fucking way. Random phone thief? Don't make me laugh.

And people seem to actively "forget" that this is a learning model, getting better with every unlock. Just like TouchID, but better.