But similar to hash collisions, a total break (arbitrary hash values can be output) isn't required for it to be a problem. Where fingerprint scanners aren't magic (especially given the sloppiness of input data), that they're defeatable in corner cases should be enough to be worrisome.

Right but exactly like hashing you can set the difficulty of breaking it to your risk tolerance.

Your phone should probably be a little loose but the retina scanner at the datacenter of the dod will be a lot stricter.

That’s not a thing (Re: dod)

Not sure about DoD specifically but many datacenters absolutely employ retina scanners, LG makes a very popular line of them.