`securityLockoutTime` is the ultimate guard of whether or not a passcode is configured.  If one wasn't configured going in, we're either creating one or not, and nothing else.