Of course, if the fingerprints are really such an easy way to see which four digits are commonly pressed, perhaps the best option would be to use only three unique digits, and then pick another digit that you always tap just after unlocking the phone. Obviously the digits disappear, but say your code was 1123, just hit where the 6 was (just below the 3) as soon as it's unlocked. Then to anyone trying to guess from fingerprints, they would be trying to guess combinations of 1, 2, 3 and 6.

If they were to then guess that only 3 of the 4 digits were used, with one being repeated, the possibilities are vastly increased by not knowing which digit is repeated OR which digit is not actually used. Off the top of my head I think it would be 36x4 (36 being the number of combinations using 3 unique digits, multiplied by four for each digit that could be un-used), meaning 144.

If you were to do the same trick, so after entering your 4-digit code containing 3 unique digits, you then hit two different fake digits (same two every time you unlock)... you would have 36x9 combinations, totally 324.

To take this to its (il)logical conclusion, you could fake-press all the digits that you're not using, but at that point you're clearly going too far and should consider just wiping off fingerprints instead.

Then again, is there really a real life use for any of this logic at all? I think not. 36 combinations rather than 24? Hell, even 324 instead of 24. Is it interesting to calculate, sure. Is it worth caring about when actually creating your passcode, not really, ultimately it will cause a minor annoyance to anyone who wants to guess the code, as they will take a little longer to get there.

That said, it's only not worth caring about in terms of the number of combinations. If you use only 3 unique digits, yet always tap the same fourth decoy-digit, while the combinations may only go from 24 to 144, there is a chance that the theif/whoever would fail to guess the plan, and therefore not think to try more than the 24 combinations.