- Your username is who you think you are.
- Your second-factor (faceprint, thumbprint, keyfob) is who you claim to be.
- Your password is your proof.
But even with a 4 digit PIN most people didn't have PINs set up on their devices, so increasing friction will not result in more security.
If you want max security now, you can simply turn off TouchID or FaceID and us a very long alpha numeric password.
Would be interesting to see whether username-less public systems suffer fewer intrusions. Some users would record their passwords in unsafe places, but they couldn't reuse a password eliminating password stuffing as an attack surface.
Of course, if you allow password resets you'd still have a kind of "backup" username presuming a person's email address could be used for the reset. But that wouldn't significantly weaken the security, arguably.