No biometric identifier is ever deterministic. Retinal scanning is no different. Your retina doesn't look exactly the same every time, every day, from all possible angles. Eyeballs swell, get infected, can be clouded. Retina signatures can even change over the course of a lifetime in somewhat rare circumstances, usually due to glaucoma or diabetes. Identification is always probabilistic.

Actually, the lowest state of the art false positive rates for biometric id is achieved by iris scans, so I have to wonder why they went with retinal scanning in this case.

Note that I'm not saying you can intentionally cause a false positive or false negative very easily. These are both highly reliable identification methods. But they're not deterministic, so if you're hashing the literal scanned signature, the hash output won't be deterministic, either. Presumably, what they're doing isn't hashing at all. Normally, for biometric id you just store the signature in a database and use a thresholding function to match against it when new scans comes in.