I think this depends a lot on your threat model. (specifically referring to phones/mobile devices) If you're at all concerned about being targeted, this is a v

I think this depends a lot on your threat model. (specifically referring to phones/mobile devices) If you're at all concerned about being targeted, this is a very valid concern. On the other hand, I think using fingerprints/biometrics is "good enough" to prevent non-targeted attacks (theft, lost device) from retrieving sensitive info, and is far better than no password or a short numeric PIN. Obviously, using a rotating alpha-numeric-symbol password is more secure, but unless you only very sporadically use your mobile device, is pretty inconvenient. (of course, it'd probably be best to use MFA here and have a PIN code along with biometrics, but I'm not aware of any consumer devices like that)