I agree. Maybe this would be harder than I'd expect, but it seems that if an attacker knows what criteria are used for identification, they could simulate a a g

I agree. Maybe this would be harder than I'd expect, but it seems that if an attacker knows what criteria are used for identification, they could simulate a a given user's typing patterns. And to collect data on how you type, they could collect it when you're typing into your text editor, IDE, website forms, or anywhere else. It seems there would also be a problem when the same person is signing in on a computer with a keyboard vs on their phone/tablet.