Can someone explain to me how something like this is technically possible? And by "explain" I don't mean "ELI5", be all the technical you want. How can you design a fingerprint reader that lets anybody in like this?
Perhaps the fingerprint reader returns a result of 0 for "valid print and not matched", result 1 for "valid print and matched", and result -1 for "not valid print". If the phone vendor code simply tests for a non-zero result code and treats this as "matched", then the situation described would occur.
It would be interesting to test with other smooth objects that might activate the reader.
What is suspected here is that registering the finger with the screen protector on is masking the shape of the finger while still registering the touch action. As a result, it's enrolling a blank print. Then anyone else can unlock it afterwards with the screen protector still on.
Consider that screen protectors are designed and tested only to make sure touch actions work correctly, but this ultrasonic fingerprint ridge-shape detection technology is new, so they're probably not mutually compatible.
I don't know what was wrong with the swipe sensor. They're discreet, easy to keep clean, and hard to screw up. Maybe the only downside is they would keep them too close to the camera lens for accidentally lens smudging.