Just to be clear on the biometrics, no normal device anyone uses sends your biometrics to apps secured by biometrics.

It’s more that your phone stores a very strong password that’s specific to that app, and your phone will automatically enter that password, but only if the phone can validate the biometric.

This is not meant to detract from anything else you said, just clearing up how that actually works.