Depends. They might have broken in without her password. For all we know her pin was "1234". They might have pulled files directly from the hardware without logging in at all. Or they might have just used her biometrics, which is legal in most jurisdictions.

That last one is really important to understand. Courts have generally ruled that refusing to give up a password falls under the fifth amendment right against self incrimination, because it's considered a form of speech. But biometric data is not speech, and can be obtained via a warrant. So if the cops are allowed to press your fingertip to an ink pad and then a piece of paper, they can also press your fingertip to the sensor on your phone. By the same token they can point the phone camera at your face, just like they can point a camera at you when they book you. It's all just biometrics, which aren't protected in the same way. (Yes, its a little more complicated than that, legally speaking, but that's basically how it's been argued in court, and many courts have agreed).

And once either of those actions happens to coincidentally unlock your phone, they have free reign to search the contents and even remove your passwords entirely for their future convenience. That all falls under the standard search and seizure provisions.