Although calculating it this way will double-count some patterns which include long lines, I would say that there ar far closer to 9! == 362880 passwords. Even if long lines cut that space in half, 150000 more than meets your minimum of 15^4.
"Don't use your fingerprint to lock/unlock devices."
"Use a long passphrase to lock your devices."
Seems touch id and face id is exactly what security experts tell you not to do.
Those are recommendations for a specific group of highly targeted individuals in specific situations. It's not "basic security", it's "basic security for people who have such damaging information on certain subjects that they may be killed for it".
For the general population, TouchID and FaceID are more secure than the most common alternative (which tends to be no passcode at all) and secure enough that common criminals aren't going to bother with it.
Stopping nation-states from intercepting your data and using it as a flimsy basis for your murder isn't something an average person needs to worry about on a day to day basis.
What about putting buttons along the sides of your phone and using chorded combinations as your passcode? Seems squeezing those buttons would be much harder to observe or record (intentionally or unintentionally).