In reply to Chris Farlee.

We should not belabor this but the problem is quiet straightforward. It's like stealing someone's finger (virtually :-). Nothing else changes. Everything works as designed.
Normally we claim identity and then we get challenged for authentication to substantiate that claim. In this case - IT APPREARS - Apple says: identify yourself (not authenticate that your are Chris). So you provide the scan of your finger. Apple runs whatever algorithm on the digital scan and compares to what is stored. If they match, you're in. If I have a digital copy of your print scan, what stops me from feeding it into the verification algorithm?
One way to address it is to ask for a secret (PIN?) that only you know.