Failure scenario: you're having a mild heart attack, but you can't call an ambulance because your phone doesn't recognize you!

(If this biometric is routinely used as a password-substitute, what are the odds that by the time you really need it, you've forgotten the password you used when you set up your account?)

Yes, a workaround for emergency services is feasible, but your average first half attack has a duration measured in hours, comes with a variety of symptoms the victim is unfamiliar with, and many folks' first response is to try to self-diagnose or ask someone about it, rather than to instantly realize "OMFG, I'm having a heart attack, ER now". Way to go if they're locked out of all the possible online sources of information that might tell them what's going on!

(And I really don't think Apple will be wanting to jump through the medical device certification hoops for OSX and the iPhone, given what the regulatory regime is like ...)