When someone is using my cell phone, I will sometimes give them the PIN number to unlock it so they don't have to ask me. Clearly, I only tell the code to people I trust not to mess up my phone. However, let's say an attacker overhears me telling someone I trust (or the person I trust later turns evil and plots to take over my phone). Either way, the attacker doesn't have physical access to the phone. What can he do? I don't think phones OS' are like laptop and desktop OS' in that the "user password" can also be used to gain remote access, but I'd like to make sure. My phone is a Windows Phone (8.1), but I'd appreciate answers for iOS and Android too.
The PIN code can only be used for unlocking the phone locally. For credentials storage, the PIN/pattern is internally translated into a password, using a phone-unique key.
Theres no way to remotely access a cell phone except for: Using Google Administrator - this uses your Google Account password to remotely access your phone, or if you install a app that allows remote access - and in this case, you configure the access password in the app itself.
And you are wrong about laptop/desktop OS too. In w7 and later, NO remote access is enabled per default. This means a password cannot be used to remotely access your laptop/desktop, unless you specifically enable remote access in the Control panel. There is a thing called "Remote assistance", but that is configured so you need to confirm (permit) the person helping you. During Remote assistance, the controlling indivual will not be allowed to input a password to bypass permit. Remote assistance is enabled per default and can be disabled in the Control panel.
However, some Linux OS:es do have a sshd running remote-accessible to allow for debugging. However, if you put your machine behind a router, any remote access will not be possible unless you specifically open the port.
Back to cell phones again: Normally, when connected to your mobile operator, your operator NATs the traffic behind their firewall (and you get a external shared IP - that is shared between multiple customers, and a non-public IP assigned to your phone), thus even if any remote access would be default open on your phone, nobody would be able to use it anyways.
Google Administrator works by having the phone "poll" the google website at regular times to check if the device should be locked, erased or tracked.