TouchID and FaceID are like setting the door to auto-lock when you leave your apartment. Sure, setting the second lock is more secure. But most people won't bother with that. Because for most people, it isn't worth the bother ex ante. TouchID and FaceID have enabled broad-population security practices in a way preaching passwords-only never could have.