True, but most people who might steal your phone are too dumb to hack it. All they're likely to do is wipe and then fence it.
As long as you take reasonable precautions, like use a passcode (or better yet, Face ID) and don't open links in strange emails, then you should be fine.
