The bottomline is that someone doesn't need to hack a server to steal your fingerprint, you leave those everywhere you go as virtual gifts to any passers-by. All they need to do is steal your phone, and that's pick-pocketing level easy.
Otherwise the data is still there in the plain, accessible by anyone who can read the flash.
Android 5 has full disk encryption but was disabled by default on the Nexus 5 (and most other phones) due to performance issues.
I didn't notice any mention of those, specially because they failed miserably last year parading full disk encryption on Nexus 6 and got bitten when reviews showed the performance degradation and lack of hardware encryption.
If it's not, then Google are starting to take the piss..