This comment could use some elaboration. For those that don't know you can use a Yubikey that supports PIV as a smart card for logging into macOS and performing a range of admin authentication operations with just the PIN, not just in the GUI but sudo as well (and of course more directly for SSH etc). It's not a perfect substitute, no ApplePay, but it means you can have a long complex password and only need a 6-8 digit PIN for most usage while still being pretty safe, and has some positives of its own in a multiuser or machine environment. It's a very reasonable option to consider IMO, even though yes it'd absolutely be nice if Apple did better on the hardware auth front.