We're at a point where this old saw needs to be retired. Yes, if a system is storing your biometric data remotely, then it can't be changed and it's a username

We're at a point where this old saw needs to be retired. Yes, if a system is storing your biometric data remotely, then it can't be changed and it's a username, not a password. But modern biometrics don't work that way, at all. The biometrics is stored client-side (hopefully securely and considerable effort is made to realize that hope), and it is used to access a private key which signs a challenge. The biometric can be revoked, the private key can be revoked, all of these things can be changed by the user. So let's say someone busts my fingerprint out of the TouchID secure enclave. That's not great (nor is it easy!), but they don't have an ability to generate a private key with it which Apple will recognize: that requires my password. So I can generate a fresh key, confirm it with my password, and now my copy of the biometric works and theirs doesn't. Edit: "courts or police can compel your fingerprint but not your password" is a completely different argument, and the solution is a way to rapidly lock out biometric authentication so that the password is a hard requirement. It also doesn't apply in a number of jurisdictions. As a practical matter, actors who are unwilling to reach for the rubber hose can't get a password, while a fingerprint just requires the willingness to manhandle someone without injuring them, and that much is basically universal.