Fingerprints are usernames, not passwords, even if some people use them as passwords.

What's the point of a password you can't change? Once it leaks, you're screwed forever.

In the autenticaion realm, there's three main things used: a) who you are ("username") b) what you know ("password") and c) what you have (smartcard, various kinds of dongles). Biometrics of any kind only fit in the first category. The other two must be changeable, or there's no point to them, since they become aliases for the username. Any authentication system needs to assume the password or the what-you-have thingy leaks or is stolen. If they can't be changed, it becomes rather difficult to lock out an attacker while still allowing the legitimate user access.