Hi sorry for the late reply, I have little free time these days.
I mean the PIN option available on your BW mobile (Android):
It may be anecdotal but I can foresee Apple users (but not only) used to this feature avoiding other stronger locking mechanisms for convenience.
Well, unfortunately, there’s no chance of both convenience and security, at least I don’t see a product that does both well (but that may be more ignorance than lack of such products).
However, the reason I suggested this feature as optional is for the people who care less about convenience and more about security. I for one have easy to type passwords which are made in a way where they are decryption unfriendly (full sentences, huge length, excessive use of space) and human friendly (sentences that make sense, instead of short passwords with random characters or symbols) so I have no issues typing in passwords all the time. Indeed, because of very restrictive work practices I have to remember my passwords. I mainly use BW for passwords that are not important (for example Steam account which I just use for browsing random stuff and not buying anything).
I think your logic is incorrect here.
As a thief would you go for the 100kg main entrance door with 5 locks or the backwall window that you can just lift up with one arm?
The security system is as strong as it’s weakest component, not as strong as its strongest. (weakest-link).
That’s why generally in robust enterprise networks there is such thing as “defense-in-depth” where all possible security measures are applied, regardless of their strength.
For example, you may have a Linux server with SSH support which has a strong non-root user as its main user, and the root user has its password set as well, or even renamed or deleted.
Adding more layers there to achieve “defense-in-depth” for example would be to add a firewall that blocks all ports including SSH port as well as moving that SSH port to another port (for ex from 22 to 3022).
By themselves these are weak security features, but together they make the system very strong.
In general to be more secure you want “defense-in-depth”.
When faced with strong security, attackers have less easy choices:
- break everything step-by-step, which may end up failing at any step
- look for easier targets (usually preferred by most attackers - that’s why most spam and scam victims are old retired people while almost nobody above 30 would fall for that).
That is great, but in practice it did happen once that I mistyped a password and I was locked out. Luckily I keep trying and found out the typo eventually. But that is a horribly close call, this imho isn’t a good feature. We are water bags with feeble mush brains, we need backups!
I think my answer to that would be to eventually buy a BW subscription so I can unlock my account or host locally a BW server.
Perhaps then that the MFA options would be usable to unlock the account?
For example you lose your master password, but you can use your authenticator’s MFA code/slide/choice, a email code and some other stuff like passkey as a 3 step process (or minimum 2 step process) to unlock your account.
I tried passkeys from google, just to see what happens and I did have a good experience to unlock things faster. However you can still fallback to weaker methods like passwords and SMS as an attacker.
Also the passkey becomes useless if whatever phone you set it up becomes unusable (gonna register one on my other phone too haha, so I don’t get screwed).
But just to not lose track of the point, the issue remains where we don’t know how Google manages passkeys and what is their security is like, and we will never know unfortunately.
In which case, a very strong master password (30+ characters) may be preferable and more secure than a passkey (If one can remember it lmao 
)
