I think it’s about plausible deniability: you can pretend you’ve forgotten your password, you can’t pretend you’ve forgotten your finger.