I wonder if when these things leak and become ever-more damaging, biometrics will basically become worthless and we will pivot to hardware tokens or something else.

There seems to be little resistance to this in the USA, and we’re also okay with abysmally bad forms of identification (SSN, birth certificates).