I think the issue is most people have email on their iphone, so you can send yourself a password reset to your phone, get your password, then use the code also generated on your phone.

Personally I have a pin on my iPhone - and I have my iPhone set to 'reset' itself if there are 10 incorrect pin attempts - so even if I lose my phone, I doubt they would get in...