This is correct only in the instance that a biometric is stored on the host. In TouchID, the biometric is stored only in the secure enclave, and is used to gen

This is correct only in the instance that a biometric is stored on the host. In TouchID, the biometric is stored only in the secure enclave, and is used to generate a private key signature, which serves as the password. Additionally, it's always possible to reset TouchID to an unauthenticated state, where it will refuse a fingerprint read until the password is typed in. There's no sense cargo-culting this bit of conventional wisdom without understanding where it comes from, and what sort of attacks it is meant to prevent.