> Touch ID specifically requires a live finger.

I remember reading about one school which implemented "live finger" readers.

How did kids hack it?

Polymer clay and a gummy bear.

Put your finger on clay and wait for it to dry. You will have your permanent mirrored fingerprint.

When required fingerprint press gummy bear against clay and then against the reader. As gummy bear holds charge, can even be cut thin etc. there is little chance to detect that it is not a real skin.