There is certainly merit to this line of thinking, however that is the scenario where the password is literally the hash of the fingerprint or facial read - thi

There is certainly merit to this line of thinking, however that is the scenario where the password is literally the hash of the fingerprint or facial read - this is a use case that's closer to a login name rather than a password. To use touchid/faceid as an example: - it requires that the password was recently entered - it's not the password, but a means of accessing a temporary token - that token is easily purged from memory by triggering SOS or failing touchid/faceid repeatedly - a range of conditions will also automatically purge the token, such as usage that doesn't match the user's behaviour, unusual movement such as scuffles, certain combinations of location/time/movement, and of course not being used for several hours (this also seems to vary based on certain conditions.) In this sense a biometric read can provide a useful level of security for most scenarios and definitely better than entering a 4-digit pin repeatedly, and infinitely better than gestural passwords which are comically easy to guess. For secure applications it's not useful, nor is a 4 or 6 digit pin, but such implementations also engage a range of security enhancements such as internet/voip via an encrypted VPN, locked down device profiles, limited access to networks and so-on. Sometimes the discussion about biometric data use in authentication tends to over-borrow from this level of security need.