Yes, and the next step would be kinect-like 3D scanning and "video magnification" for pulse detection ( http://people.csail.mit.edu/mrub/vidmag/ ), but these too could be compromised with some effort.

That's why these should be used only as a replacement for usernames and not for passwords.