iPad data privacy concern

On older iPad devices (5^th generation / iOS 10.x.x), is there a potential privacy/data security issue whereby photos are not protected by the devices general password to access ‘by default’, or put another way, if a user messed about with the device’s security & privacy settings, could they make the photos stored on the device accessible without having to first enter the devices PIN/password?

I don’t deal with Apple/iOS devices routinely so I am unsure on the security & privacy setting defaults which could possibly be disabled by as unexperienced user, but I need to look into an accusation whereby a colleague claims they can access photos on a team iPad device without having to first enter password to access the device. I am informed the device have a reasonably complex password to access set which not/has been disabled, but the primary user does not use other controls such as Touch ID or Face ID.

If you are an experienced iPad/iPhone user who is familiar with the current and previous security & privacy settings available to users, is it even possible for a naïve or unexperienced user to disable security/privacy features that would subsequently make photos accessible without first entering the devices PIN? And if there is such an option, I presume this isn’t a default? And a user has gone into the security and privacy settings and disabled something incredibly important?

If you can make certain files/apps accessible on an iPad WITHOUT the password (what a bizarre option??!!), are there any other types of files on the device that could also be accessed without the password if whichever security data privacy feature has been turned off an disabled, or is the feature specific to a photo gallery? I’m pretty sure if ‘photos are not protected by an iPad password by default’ was genuinely the reality on 5^th gen iPad devices, this would be far more widely talked about, as to what needs enabling to protect such files. But I could be wrong.