Comment by aquadrop

Yes, touchId/faceId sits in between, it's quick access token, which is enough for 95% of the time, but those other 5% are very important.