The thief would, perform in this order of chances below are:
- Throw away the SIM card (see below)
- Attempt to unlock boot-loader (if its locked) which results in wipe of
/data and /cache
- Pop in a SIM card that does not have PIN lock.
If an incorrect PIN is entered more than three times, a PUK is needed!
Now the chances of the thief walking into the carrier's shop, asking for the PUK code is very slim hence why number one (in the above) is done first, even if digging around trying to figure out what the number is.
And furthermore, some, if not all, carriers have the handset, locked to the network in itself.
Sure they will get the IMEI and walk into a Mobile shop that specializes in phone/network unlocking and get the handset freed from the carrier's network.
So it would be safe to say the SIM card's PIN lock is secure somewhat!