> Rather than giving a binary answer, as a password does, the API can hand over a score to indicate how confident it is that you really are you

Helpful of them to give everybody trying to break this a measure of how well they are doing. Much easier to optimize against than a binary succeed/fail.