It's effectively like using one password for every app/site authentication. What if the hashes/keys leak out? Then how easy would it be to change your keys for

It's effectively like using one password for every app/site authentication. What if the hashes/keys leak out? Then how easy would it be to change your keys for other sites while still using the same biometrics?