But more often you either don't change them many times a day (seriously, how many do that?) or don't have PIN at all. Peeking someone's PIN code and snooping around the phone while the owner is away is much much easier than reconstructing the fingerprint well enough to pass the TouchID. It was said more than once: TouhcID is not perfect, but better than nothing, and before TouchID "nothing" was more likely, because all of the hassle with PIN.