That's a great question. I would hope no company would voluntarily put themselves in that situation.

Biometrics are useful for authentication, but I struggle with a safe use for authorization, per se. Just for the reason you identified.