It's something I feel Windows Hello gets right some of the time, but not enough recognition for. Windows Hello can be set to (and I believe defaults to) require PINs/passwords on the first time a device boots up or asks a security challenge, thereby the face rec or thumbprint ID challenge itself is only for "repeat" checks / secondary factor.