-Set “Erase Data” so the phone will be wiped after 10 failed passcode attempts (with this option, I feel comfortable with a non-obvious 6 digit numeric passcode).
-Under “Allow Access When Locked”, probably all should be deselected, but definitely Wallet and Siri (Siri can give away privacy in sooo many ways).
-If you feel you may be compelled to unlock the phone (perhaps at a border crossing?) don’t register the most obvious fingers. After 3 failed attempts it will require the passcode. Of course then you may have to deal with ‘requests’ for the code, but at least you’ve closed one avenue.