and when the fingerprint database is stolen and shared with multiple adversarial parties? they now have your password and its gonna be hard to update / change yours.

This happened with the opm hack and a big one in India or Indonesia or something not too long ago I think.