Apple’s authentication of those factors, or a separate entry point. It is not certainly not unheard of to leave gaping security holes, sometimes ones which bypass multiple security measures (why the downvote?).