The fingerprint is just to authenticate to your local device. So an attacker with access to your fingerprint can't get at your account without also having your

The fingerprint is just to authenticate to your local device. So an attacker with access to your fingerprint can't get at your account without also having your phone (which stores the private key _actually_ used for remote authentication in secure, tamper-resistant hardware).