I would guess that most hardware/browsers that support the biometric API today (on iPhone/mac laptop anyway) the fingerprint/authentication is done on and tied

I would guess that most hardware/browsers that support the biometric API today (on iPhone/mac laptop anyway) the fingerprint/authentication is done on and tied to the device. So to logon to a website with it you would need access to someones unlocked phone or laptop - 99% of the time that would probably give you access to their email which would enable you todo a password reset anyway.