This assumes user is the only person with physical access to unlocked phone.

All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.

This is solvable by adding big huge warning that ADB is running. Not by removing feature.