[jeroenhd]

AFAIK many phones store the fingerprints on-chip. I haven't looked too deeply into it, though, so it's possible there's a brand out there that streams fingerprint information as a video.

On Android, there are different levels of biometrics: https://source.android.com/docs/security/features/biometric If your fingerprint scanner reports Class 3/STRONG, hardware key stores are a requirement. Anything Class 2/WEAK or higher is supposed to make sure a kernel compromise cannot leak keys/authenticate to the OS. If it's Class 1/CONVENIENCE, simply running the biometrics in the trusted execution environment (think "secure VM acting as TPM") is also permitted.

On iOS the TPM/secure element deals with credentials, they're not submitted to the CPU.