I agree. I posted the solution that worked for my wife here based on the content of this thread. Hopefully it will help someone
Josh
I just got off the phone with Apple regarding this problem. The first level tech had not heard it and suggested turning off the passcode function while she searched for a solution. However, the senior advisor she ultimately transferred me to had experience with the problem and verified Josh's solution (clear the Safari history and data). The Sr. tech suggested that some Safari add-ons
* (even from the App Store) can allow cookies. etc. to be placed on the phone that lead to this type of problem as you browse. She also said that using the private browsing feature in Safari may help.
While waiting for the first tech I did some trouble shooting and discovered that the "You must change your passcode . . ." message only showed up when I was on the home page. If I was on any other page and the phone went to sleep (whether on its own or I forced it), the message did not come on when I woke up the phone. But the message would return immediately upon going to the home page. So while the cause is apparently related to Safari, the way it shows up looks for all the world like an iOS prompt.
I did want to make two observations about the solutions. When I cleared the Safari history and data I lost all of the pages (about 7) I had open in Safari. So I recommend if you are going to use that solution you go to Safari and see what you have open and save it before you clear the history/data. Secondly, I learned pretty quickly from ensuing bank emails that the consequence of turning the passcode off and then back on causes you to lose all your Apple Pay connections and you will have to re-enter them.
-------
*In my case, I have 1Blocker installed to manage all the pop-ups that now blanket the web - whether you are reading news, following FB links, or shopping. I am not suggesting that 1Blocker itself is a problem, but I've read that there are many businesses, news organizations, and web-developers who are losing revenue and are very angry with web blockers and would not be above wanting to find ways to retaliate. And I am especially sympathetic to small developers and bloggers that are trying to make ends meet and need the revenue lost by ad-blockers. Unfortunately, what used to be simple ads have become guessing games on how to get out of an ad to read what you were browsing for in the first place.
While this latter part looks like a RANT, I included it so other people with the problem can assess what they may have installed or encountered that could be the root of this problem. If we collectively share the history someone may may be able to ascertain the cause - because someone is clearly out there messing with iPhone users. It would be great to develop enough information that future users who come across this thread will know what to do and maybe even what the cause is.