You can also disable the simple pin (4-digit) and switch to a real passphrase as the alternative authentication mechanism. So if the touch ID fails for whatever

You can also disable the simple pin (4-digit) and switch to a real passphrase as the alternative authentication mechanism. So if the touch ID fails for whatever reason, you need to enter that complex passphrase (which should be a rare occurrence). I think that's more secure than a 4 digit pin also, which a friend or attacker could witness you entering from a distance.