>Basic security precautions for non-profits and journalists in the United States, early 2019.

Those are recommendations for a specific group of highly targeted individuals in specific situations. It's not "basic security", it's "basic security for people who have such damaging information on certain subjects that they may be killed for it".

For the general population, TouchID and FaceID are more secure than the most common alternative (which tends to be no passcode at all) and secure enough that common criminals aren't going to bother with it.

Stopping nation-states from intercepting your data and using it as a flimsy basis for your murder isn't something an average person needs to worry about on a day to day basis.

Yes, I forget how much of this was because of forgeability and how much was because of the ambiguity of digital rights in America. Compelling someone to share a passcode was considered a 5th amendment violation but we collect biological samples all the time with just a warrant so biological locks seemed less safe.