They could start with the cloud and try other means of getting in, there are a surprisingly large number of ways to get into a device to figure out the password other than from the person.