Fingerprint and face recognition don't have the same threat models. And two differ from password too. For end users, fingerprint makes sense:

- Stealing fingerprint requires access to your fingerprint in the first place. That narrows down the attack surface A LOT. - Coercing someone to authenticate is possible for password too. Unlike fingerprints passwords can be stolen remotely. - People tend to use same PIN everywhere. Therefore "can't change your biometric info" isn't that big of a problem. Fingerprints aren't prone to dictionary attack either because there are no "common fingerprints".

Face recognition can be bypassed more easily thanks to a huge database of faces called facebook.

But we shouldn't reject a security solution outright before properly analyzing the threat model. They all can have their legitimate use cases for certain scenarios.