That's very true. IMO Apple has already thought of this and I think they're not storing the fingerprint or even a direct hash or other signature of it on the device. They may be using some sort of unique key (a salt perhaps?) that is used in conjunction with the fingerprint to generate the final password.

It's also possible that it may not be a "password" in the conventional sense. Maybe the fingerprint only serves as part of the private key of a public/private key pair where only the public key is stored on the device itself and the private key must be generated each time with a scan of the finger.

This is all speculation, of course.