In Ionic Identity Vault prior to 5, a local root attacker on an Android device can bypass biometric authentication.
ionic identity vault