I think part this is the fact that a lower complexity password can always be changed if compromised. If your fingerprint is compromised, you can't just generate a new one.