I don’t think people keep behaving like it’s not true. They just have different priorities. Yes, “something you have + something you know” is more secure, but

I don’t think people keep behaving like it’s not true. They just have different priorities. Yes, “something you have + something you know” is more secure, but security is not a binary thing, and people’s real world behaviors need to be accounted for. Before biometric authentication was available in cell phones, I had no passcode at all. My device’s security was just the physical security of the device itself. Constantly entering a passcode was just too much hassle, let alone a proper high-strength passcode. Moving to biometric authentication massively improved my security. Lots of people I know were in the same boat, or maybe had a four-digit passcode equal to their birthday and/or ATM PIN. It’s not foolproof but it’s good enough for almost everyone.