The way it was explained to me is, a fingerprint (or whatever) is quite difficult to copy...but as soon as you scan it and send it over a network for verification, it's no longer a fingerprint but a datastream just like any other password, except that this is a password you can't change if it gets compromised.

Therefore, biometrics can conceivably be useful if used cautiously on a single device or a well-secured local network. As soon as you start sending them over the public internet or anywhere else that it's possible for a hacker to intercept, all advantage is lost.