Its a rabbit hole, which is what I referred as layers of security/obscurity giving a sense of security. Theoretically the person touches the touchID for the key usage, however in reality the usage fatigue kicks in, performance considerations kick in and you end up with a small window where risk is considered worth the trade off. The key is in the cache available for the process/program that you already consented to in the last few occurrences without explicit prompt. The attack vector is that I am behaving nice for the first time to gain your trust, and then I do what I planned for. Worst, in supply chain attacks your program was compromised by a third party.

My original thought was that people often confuse complexity as security. Its added friction layer for sure, however it cuts both ways, makes slightly harder for every day hacker, the monitoring becomes harder as well.