The setting that enables biometrics with a fallback to device PIN seems to be a weakness to me as you can force the biometrics to fail and device PIN can be weak. I suggest that if an extra password has been added that an option to fallback to that rather than device PIN should be available.

This problem is on a Mac. I see that on mobile devices you can turn off the fallback to PIN and it will force a re-login.