I hope theft counts as a realistic (and common) situation. Pickpocket grabs console, runs away, turns it on and get this message (or error message from their perspective):
The first line as search term gave me an old Reddit thread as top result with duckduckgo, startpage and google (Yes I know, startpage uses google, but sometimes I get different results). While this thread is old and talks about A9LH, all needed information is mentioned: Booting from NAND, booting from SD, deleting file.
This is enough to give an attacker with no prior knowledge about 3DS and Luma CFW the idea, that an easy bypass is possible. Sooner or later they will find the official Github page and the wiki
The official manual tells right away how to get rid of the lock.
It literally takes the thief less than five minutes to remove the PIN and put them in a position to sell the stolen good (good condition 3DS aren't exactly cheap at the moment).
If we have good(?) or bad(?) luck (depends on the view), the search engines will now pick up this thread as a manual how to bypass the Luma3DS PIN code.
⟹ Luma3DS PIN is not an effective theft deterrent.