My usernames and passwords auto-fill with faceID already. Lots of forms even (somehow?) auto-submit after that, don't even have to press a button.

The forms don’t. The browser does. There’s a set of heuristics.

The problem with autofill is it doesn’t help if the person keeps screwing up their passwords, changing them, or ends up with 5 different passwords in the password manager for the same site.

All of which I’ve seen.