You should check out biometric key-binding, basically you take a biometric and a password to build a template that can only authenticate the user if both are present.

Likewise, I'm curious if there's a fallback authentication method for people who lose a finger, get their faces deformed, etc.

Deformation is a very real challenge for biometrics, but there is also a lot of active research in the area.