Something you have. Something you know. Something you are.
The problem with the third factor has always been a balance between cost, inconvenience and how easy it is to turn it into just another something an attacker has.
Retinographic analysis is gold standard but it's hellishly expensive. Fingerprints can be copied. Easily. Facial and behavioural analysis sit somewhere in the middle, with too much scope for false negatives.
So fingerprints aren't a username or password because they're not that factor... But used alone, they can be as weak as a username, in many senses.
The problem with the third factor has always been a balance between cost, inconvenience and how easy it is to turn it into just another something an attacker has.
Retinographic analysis is gold standard but it's hellishly expensive. Fingerprints can be copied. Easily. Facial and behavioural analysis sit somewhere in the middle, with too much scope for false negatives.
So fingerprints aren't a username or password because they're not that factor... But used alone, they can be as weak as a username, in many senses.