Two things. Every transaction needs your face, fingerprint or passcode - so an unlocked phone alone isn't enough. And adding your account to a new device requires approval from a device you have already authorized, so a stranger can't quietly register their own
