Produce me a living breathing human with a chosen fingerprint -- biometrics are not "a picture of your fingerprint is the password."

But similar to hash collisions, a total break (arbitrary hash values can be output) isn't required for it to be a problem. Where fingerprint scanners aren't magic (especially given the sloppiness of input data), that they're defeatable in corner cases should be enough to be worrisome.

Right but exactly like hashing you can set the difficulty of breaking it to your risk tolerance.

Your phone should probably be a little loose but the retina scanner at the datacenter of the dod will be a lot stricter.

That’s not a thing (Re: dod)

Not sure about DoD specifically but many datacenters absolutely employ retina scanners, LG makes a very popular line of them.