This is correct only in the instance that a biometric is stored on the host.

In TouchID, the biometric is stored only in the secure enclave, and is used to generate a private key signature, which serves as the password.

Additionally, it's always possible to reset TouchID to an unauthenticated state, where it will refuse a fingerprint read until the password is typed in.

There's no sense cargo-culting this bit of conventional wisdom without understanding where it comes from, and what sort of attacks it is meant to prevent.

Technically you are correct and I used to complain about this myself for years. But it seems like at least for consumers they’re often content to have authentication equal authorization so I feel like mostly this battle has been lost in the consumer space.

huh? fingerprints are not 'usernames' (you don't just provide a 'username' for an applepay authorization for example).

and yes, adding this in you do _not_ have to type out your sudo password and can grant permissions using only touch id.