There are a few convenient scapegoats here but ultimately in this case it is not biometric unlock that enabled this but rather characteristic of the Active Directory's design (I'm not sure I will call it a weakness).
For Android and iOS if you forget your PIN code I believe you are screwed, as in no one can decrypt your device for you.
For Android and iOS if you forget your PIN code I believe you are screwed, as in no one can decrypt your device for you.