I have the same problem since the Marshmallow update. Galaxy S6, corporate e-mail policy applied. In my case, the change led to a chain reaction that caused my phone to hard reset. Normally, I have it set to lock right away with the power button like others in this thread. It makes my phone much more secure than my company's default ~30 min lock time, plus it prevents the phone from unlocking itself in my pocket, which would happen frequently and then permit all kinds of weird actions to be ran on my phone without my knowledge. Indeed, after the Marshmallow update, random games would launch while my phone was in my pocket. If the "don't turn on screen while phone is in a dark place" setting was enabled, it never helped, and I honestly forget if that feature even was in Samsung's Lollipop or not. I do see it in Marshmallow now and it's enabled. We'll see if it helps. Anyway, I thought I'd fixed the problem by resetting things to the way I wanted, figuring Marshmallow or a refresh of corporate policy at update time had reset my settings one time only.
Well, thanks to my more secure setting being repeatedly overridden and the security being automatically downgraded behind my back after I'd set it to my instant lock, my screen must have turned on on my pocket and then unlocked, and then somehow got to a hard reset condition. The next time I went to use my phone, it asked for my password, and then started a factory reset. I won't go into what I lost or point every finger in one direction; the bottom line is Google's change was a very poor one here and had the net effect of reducing security. And leading to data loss. But as to how the factory reset occurred so easily is another flaw. As far as I know, the "erase phone after X failed login attempts" was not enabled, but on the reset phone, the option is grayed out yet appears off.
I'd say for me, it was a perfect storm of severe software flaws between Google and Samsung that led to this. Google certainly created the initial condition by permitting the silent security setting downgrade in this version, and then Samsung took it from there all the rest of the way to hell. I own some blame too for whatever data loss I got since my last backup (at least the cloud has most things).
Would be great if we could get this fixed. I don't trust my phone's current settings to work perfectly until I can get preferred lock settings to stick beyond a few hours (yes, it reverted back to ~30 min during the day after only a few hours). Terrible.