Then you have a recovery password based on "enter your iTunes password" or a device password. Or, worst case, erase the device and restore from iCloud backup,

Then you have a recovery password based on "enter your iTunes password" or a device password. Or, worst case, erase the device and restore from iCloud backup, but iTunes password as backup seems more than adequate. The objective should be PIN+fpr for routine use, and a longer password when that doesn't work (or on system boot). I'd be fine with PIN || fpr sometimes when it's even lower risk (e.g. when connected to your home wifi).