Yes, recent iOS updates tried to force people like my parents to have passwords or logins that are too complex and simply unnecessary for them. If you use iPad in your own home, there's no reason to "authenticate" on every open (my parents surely don't want/can't perform the fingerprinting every time -- not to mention that if the device prompt them to enter a new complex code they might even type in twice but they will never remember it, or be prepared to write it down first, the expect the device to "just work" and not to have to maintain some other external notice book with the access codes, and I fully understand that). It's not easy to match the security "requirements" and general "common" use.
The iPad of my parents (that they use mostly at home) seems to insist on more complex security procedures for my parents to watch the pictures of the kids than the procedures which secured the launch US nuclear missiles (the later had simply the code 00000000 https://arstechnica.com/tech-policy/2013/12/launch-code-for-... ).
Having done a security review on a photos app for a company with high customer trust, and knowing what people put in their photo shares... photo and document shares are one of the highest risk areas for people. I didn't know about this until the review but when it was pointed out to me, it's obvious that for some people having their photos stolen is massively worse than credit card fraud or other recoverable things. You can't get those docs and photos back.
However that means that you are right, it's nuclear launch code level security for everyone's photos.
We did think about not having pin codes or Touch ID enabled, but there are enough kids visiting my grandparents that the one thing we're afraid of is them deleting their files, mail, sending messages, etc.
Thankfully, none of them forget their PIN codes. My grandmother also has Touch ID on her iPad, even easier.
The iPad of my parents (that they use mostly at home) seems to insist on more complex security procedures for my parents to watch the pictures of the kids than the procedures which secured the launch US nuclear missiles (the later had simply the code 00000000 https://arstechnica.com/tech-policy/2013/12/launch-code-for-... ).
Balancing the security and usability is hard.