It has been said many times already, biometric data is not a password it is a login/user name.
I would not use it for authentication against the missile launch system, but my ex will probably not chop of my finger to access my Facebook account, nor will random bots trying to access my Gmail account.
Yes, public in a different model, with a different set of threats, but that's irrelevant to what the analogy is trying to convey.
It's a human trait to evaluate and disseminate new concepts though existing concepts. Everything is unique, if you want to refine or disprove the analogy it's not enough to call it wrong repeatedly, you need to accept that specific frame of reference is suggestive to those who chose it, and formulate your arguments from that perspective.
Biometric data is a form of identity, as is the combination of username and password. Different forms of identity have different security trade-offs and removing nuance by comparing it to a single component of different form of identity is always counter-productive. Biometric authentication is its own thing with its own security characteristics that need to be understood outside the context of what we know about usernames and passwords.
Therein lies the issue with Biometric data being both username and password, for the most part. That most of the data is easily replicable aside, the fact is that you cannot control the cycle of your "credentials regeneration" since you're tied to the aging process. On top of that, the regeneration is even fairly predictable with current and past technology, and even non-technical solutions could accurately predict the physical changes in a person as they age.
Biometric data is a matter of convenience, not really security. Combine with an additional password, it at least serves the role of a Username well. For low-value items, it can make sense, provided proper pre-cautions are taken for actually sensitive data. (e.g., unlocking your phone is fine provided that sensitive data is protected with additional precautions).
With a username, I can abandon the account and sign up for a new one with a new username. I can't do that with biometric auth. And unlike a username, it requires an advanced adversary to be able to fake it, so it's also unlike traditional usernames in that way. Unless, of course, you somehow have an unconscious principal, in which case biometric authentication can be significantly less secure than a username and password, which wouldn't be divulged by someone unresponsive.
Biometric auth can also be much more secure under certain circumstances. When you combine it with, for example, a security guard that ensures that someone is using their own fingerprint/eye/face/etc, biometric authentication can make more sense than username and password. It's entirely situational which one works best.
There's entirely too many people who think it's clever to notice differences between biometric authentication and passwords and to say that it's, instead, a username. And it's just flat wrong and needs to be called out. It's also flat out wrong for Apple to have equated it with a password in the first place, so that should also be called out. It's all identity and the security of identity validation is always situational. There are no universals and exploitable flaws hide the empty space when we try to put square pegs in round holes.
When you want to revoke you timestamped biometric package you just push it to some online revocation list.
You would generate a new package, with the same biometrics, but with a timestamp after the revocation date of the previous package, just like today you can get a new passport with the same data as the old one.