DeletedUser406 I have a 6-digit PIN and fingerprint unlock (Pixel 6a). Is this enough? Can thieves get past that?
To better understand and evaluate the situation, three questions:
Do you mean, that your primary unlock method ("Before First Unlock" (BFU)) is the 6-digit PIN and the secondary unlock method ("After First Unlock" (AFU)) is the fingerprint?
When you mention thieves, can we assume, this is about "ordinary" low-ressource street criminals, that mostly are interested in money, e.g. by selling the device and/or ripping off deposit money (from e-commerce accounts, maybe online banking)? We are not dealing with high-profile thieves (e.g. from organized crime) that specifically target you and put extraordinary resources into such hacking attempt, right?
For the fingerprint: How many fingers did you register?
Reasons for why I am asking:
ad 1.) and 2.)
The shorter the PIN/Passwort (more exactly: the less cryptographic entropy there is in the secret), the more one has to rely on hardware throttling that is to hamper and slow down attempts to guess / brute-force the secret.
Until today, there is no evidence yet, that these feature was broken for the currently supported phone models (such as your Pixel 6a). More details on the throttling and the drive encryption can be found on the main website: https://grapheneos.org/faq#encryption .
For now, the consequence is, that even a (randomly generated!) 6-digit PINs will probably take "too long" to guess for the "common" attacker (i.e. one that does not have access to unpublished exploits or the ability to dismantle and cryptoanalyze your chips on microscopic or even nanoscopic level).
One should expect, that this will change sometime in the future. However, it's entirely unclear when this will be. Hopefully, way after the device has lost its function and is no longer of particular relevance for you and the theoretical attacker.
Generally speaking, the more complex (i.e. more entropic) your secret is, the less you have to make above bet; on the other hand typing a more complex secret becomes inevitably more uncomfortable.
ad 3.)
The more "fingers" one registers (including multiple different registrations of the same finger), the more comfortable is the unlock, but the higher the probability that the device erroneously mistakes and accepts a foreign fingerprint as yours.
Anecdotal reference: There was an actual report of such a false fingerprint reading, posted by IT-Security- and Privacy-Advisor and Blogger Mike Kuketz, who was surprised when he found his Pixel 8 irregularly unlocked by his own daughter... (Original Message in German: https://www.kuketz-blog.de/fingerabdruck-sensor-tochter-kann-google-pixel-8-entsperren/# )
So, purely from a security perspective, it is better to only have exactly one finger registered. Naturally, this can make unlocking more difficult and more prone to problems, when you can't use that specific finger.
Note: The relatively new 2-Factor ( Pin or PW + biometrics) feature would additionally minimize the associated risk. But more would make this answer even longer. And bring us back to question 1. (Maybe you already use it - or decided against it. Both can be valid choices.)