Theoretically, if using the "it passes a graphical representation of the fingerprint back to the OS" models, it could be done if assuming a method to reliably d

Theoretically, if using the "it passes a graphical representation of the fingerprint back to the OS" models, it could be done if assuming a method to reliably derive strong cryptographic keys from a fingerprint scan. Reliably mapping to the same key while not dropping down to abysmal entropy probably makes this intractably, hence the need for a TPM.