You are correct. The only thing more sensitive than a fingerprint are the retinal eye scans you see in movies. Criminals will find a way a la
Jurassic Park 1 to steal that data eventually and override 2FA. Phones are hot commodities unless you are Lord of the Flipphone.
As an example, my first Duke card prominently had my SSN on the front with my picture. I had more than one midterm with the same on the front to make grade entry easier. (Aside-you've hit the jackpot beyond the easy A if you took Intro to Jazz and don't mind the prison time.) As noted above, I'm Jurassic compared to many of DBR denizens, but FDR didn't personally hand out my SS card.