I'm not aware of case law on point, other than Riley, which you mention (which doesn't mean that there isn't any - I'm not a specialist in this area).
But, I think that the answer would be that you do have an expectation of privacy because the Riley holding that there was an expectation of privacy in a smart phone didn't really hinge in any meaningful way on the existence of a password. The linked summary of the Riley decision explains the court's reasoning as follows:
Chief Justice John G. Roberts, Jr. wrote the opinion for the
unanimous Court. The Court held that the warrantless search exception
following an arrest exists for the purposes of protecting officer
safety and preserving evidence, neither of which is at issue in the
search of digital data. The digital data cannot be used as a weapon to
harm an arresting officer, and police officers have the ability to
preserve evidence while awaiting a warrant by disconnecting the phone
from the network and placing the phone in a "Faraday bag." The Court
characterized cell phones as minicomputers filled with massive amounts
of private information, which distinguished them from the traditional
items that can be seized from an arrestee's person, such as a wallet.
The Court also held that information accessible via the phone but
stored using "cloud computing" is not even "on the arrestee's person."
Nonetheless, the Court held that some warrantless searches of cell
phones might be permitted in an emergency: when the government's
interests are so compelling that a search would be reasonable.
Justice Samuel A. Alito, Jr. wrote an opinion concurring in part and
concurring in the judgment in which he expressed doubt that the
warrantless search exception following an arrest exists for the sole
or primary purposes of protecting officer safety and preserving
evidence. In light of the privacy interests at stake, however, he
agreed that the majority's conclusion was the best solution. Justice
Alito also suggested that the legislature enact laws that draw
reasonable distinctions regarding when and what information within a
phone can be reasonably searched following an arrest.
The 4th Amendment expressly protects "papers" in your possession, which can't be password protected, and a smart phone file is analogous to a "paper" for 4th Amendment purposes. Your expectation of privacy in an unlocked smart phone flows from your exclusive possession of the phone as a piece of tangible personal property containing information, and not just from the password protection. In the same vein, I don't think that you would need to have a lock on a diary to have an expectation of privacy in it.
This said, this is a cutting edge area of the law and password protection for a smart phone provides both more practical protection and potentially a less ambiguous cases of legal protection from search (since it brings you closer to the facts of Riley), and is therefore still a good idea.