My thought is that biometrics should be the root of identity, not the endpoint. You shouldn't need to scan your retina, fingerprint, or face at every point you want to verify your identity. Instead you use other things like public key cryptography to verify your identity remotely, id cards (perhaps with strong cryptography) for in-person interactions, etc.

Lost/stolen cryptographic keys or ID cards could be revoked and would require a trip to your a certified biometric verification facility where a thorough in-person inspection would confirm that your fingerprints are real, you aren't using a fake eye, etc. Then you'd be issued new keys/cards at that location. Loss of ID is inconvenient, but not catastrophic. Leaking your biometrics is irrelevant.

Is it an infallible system? Certainly not, but it should be able to uniquely identify someone and not allow faking biometrics.