Fair - to be pedantic, no IDP should accept your biometrics as a credential on its own, addressable from anywhere on the internet.

The goal is that an attacker has to steal your physical device and get access to your biometrics, which is significantly more work than spraying aardvark to zebra against an ROPC endpoint.