[pgoggijr]

This wouldn't just require them to have your face and fingerprint though - This would require them to

1. Have access to your phone

2. Be able to spoof the phone's authentication mechanisms (whether that be fingerprint / face)

In this regard, it passes the 2FA test (something that you own, and something that you are).

While it's true that you can't really change your face or fingerprint, this facilitates moving away from the "password repeated across multiple accounts" landscape of insecurity.