This has nothing to do with keeping people safe.

...and...

some people are gullible enough to go into a hidden setting on their phone and enable that in order to install an app from a random Chinese website

are kind of contradictory.

I may well be missing something, but this reads to me as code execution on user action, not lock bypass.

Like, you couldn’t get a locked phone that hadn’t already been compromised to do anything because it would be locked so you’d have no way to run the code that triggers the compromise.

Am I not interpreting things correctly?

[edit: ah, I guess “An attacker with memory write capability” might cover attackers with physical access to the device and external hardware attached to its circuit board that can write to the memory directly?]