I believe they're recommending setting your phone up in a "lock immediately upon sleep; require password after five minutes" configuration. Passwords are bette

I believe they're recommending setting your phone up in a "lock immediately upon sleep; require password after five minutes" configuration. Passwords are better than biometrics for security; but between password validations, presuming some level of convenience is needed, using biometrics to check that the same person is still there is better than "just stay unlocked for a few minutes even after being put to sleep". It's like HTTP Basic Auth (sending credentials with every request), vs. logging in, receiving a short-lived session cookie, and then sending that session cookie with your requests for a few minutes.