From an Occam's Razor POV: it would be simpler for some agency to require a backdoor or transfer the character-based unlock, which they could apply whether the phone has a finger-reader or not. Since I haven't read the entire codebase of any of the operating systems I use, my paranoid self says "Expect root-ation!" while my normal self says "Get back to work, quit reading and writing internet commments!"