Don't they need both physical access to device + fingerprints/face?