Phone security will soon hinge on people’s behavior—but that could make it easier for the government to unlock the devices