The lowest of low-hanging fruit is to allow time-based one-time passwords (TOTP) to let something like 1Password handle that for you. But ideally, they would forgoe this entirely and support passkeys. So with the changes so far, this is what onboarding could look like:
Speaking of nonsense banking apps do, this drives me up the wall: After a cold start, it throws up the login screen and starts a biometric auth session. Entirely unnecessary. Determine sensitive parts of the app and require auth to unlock them for the rest of the session.