This was not a negation, but a helpful clarification of what assumptions are made in either case (and thus, what your threat model must consider). Namely: if y

This was not a negation, but a helpful clarification of what assumptions are made in either case (and thus, what your threat model must consider). Namely: if you are forced to comply, it doesn't matter in either case. If your password can be "obtained through a post-it, [...] phishing, guessing" etc. (key logger), then you might be better off with biometric authentication. If your fingerprint can easily be extracted (and the sensor be fooled by it easily), then you might be better off sticking with the password. Those clarifications give you a good way to think about the tradeoffs.