Don't know how vanilla this is, but on a Moto g^6 I have configured biometric auth but have to auth via PIN 1) every time I boot the phone and 2) every 24 hours.

Waiting for a case where the FBI bangs down Google's door to get access to a locked Android phone before I make any assumptions about the security implications of that though.