Presumably they will need mail notifications enabled on the Lock Screen as well.

The described attack in TFA seems to involve learning the phone owner's passcode (for the phone), so no lock screen shenanigans needed.