Because that's how you model your threats? You assume things like someone won't be able to physically take your RAM and read whatever data they want, for example. If you can't assume that, then you implement measures against it like soldering the RAM to the mainboard.
This was not a negation, but a helpful clarification of what assumptions are made in either case (and thus, what your threat model must consider).
Namely: if you are forced to comply, it doesn't matter in either case.
If your password can be "obtained through a post-it, [...] phishing, guessing" etc. (key logger), then you might be better off with biometric authentication.
If your fingerprint can easily be extracted (and the sensor be fooled by it easily), then you might be better off sticking with the password.
Those clarifications give you a good way to think about the tradeoffs.
