While I try not to underestimate conniving boyfriends, girlfriends, spouses, friends, parents, siblings, children, and grandparents, I am reasonably confident they will not employ a cracker bot from def con when I have momentarily become separated from my phone. For this reason, I lock my phone.

Or because you might have to use your work email on it, and exchange forces you lock your screen if you want to sync emails. Company policy so that you have a bit of security in case your phone gets stolen. Not everyone would have a robot to try all the PIN numbers just to steal you funny-cat-pictures-work-emails.