If a user ID is sufficiently long, there’s no practical difference between that and a passcode (it becomes a “login key” which both uniquely identifies the user

If a user ID is sufficiently long, there’s no practical difference between that and a passcode (it becomes a “login key” which both uniquely identifies the user and acts as a secret). If everyone in the world had a secret 128 bit user ID, we wouldn’t need passcodes. Having the iPhone X scan a device-specific, random pattern of the user’s face is somewhat close to that.