Definitely, and, on the other hand, if that's true there will only be a client side verification, which will be defeated by a jailbreak sooner or later. When it happens anyone who steals your phone will have an easy way to your money as well I guess.
There is zero chance that client side verification is the only thing that will be used to authenticate purchases. Presumably the fingerprint is used to unlock your saved iTunes/iCloud password, which is then sent to Apple's servers and verified as usual. If your phone is stolen, change your password and they'll be locked out, fingerprint or no.
I agree, my point anyway was that the problem remains even if everything works as you described, up until you notice that the phone is missing and find a way to get online and change the password of your own itunes account