To clarify, biometrics are only used for local authentication against the platform authenticator. An attacker still needs the authenticators private data, too. The authentication against the service is using public key crypto.

Also, you should be able to use a platform authenticator with a PIN.