Correct. You can also “forget” a pin or pattern but not your fingerprint or face. I usually delete everything that I don’t want them to see and then turn it off. So you don’t even have to disable it. After a restart a pattern/pin is always required.