Biometrics may not be easy to change, but they are a lot harder to copy than passwords. How many people are likely to be targeted by an organization with the resources to covertly steal and duplicate peoples fingerprints?

For the vast majority of users, the threat model looks like "I don't want that creep who just stole my purse to be able to log in to my iPhone", not "I am guarding state secrets and a potential target of Kremlin agents".

Passwords get stolen and used all the time, but I have yet to hear stories of everyday thieves breaking into iPhones with stolen fingerprints.