Securing user secrets in KeyChain vs Keychain+Biometrics

Question

The common approach to secure user secrets in native applications seems to be storing the secret in keychain and adding an additional layer of protection by way of biometrics/touchId/FaceID.

My questions:

• Does adding the additional layer of protection (biometrics) make your app any more secure? If the attacker was able to unlock your phone using the very same biometrics you use to secure your app, what advantage have you gained?

• What attack vectors are you opened to, for an app to be securing user data in keychain but not using biometrics as the additional second factor?

• some apps, also use 4 digit PIN entry as an alternative to biometrics, isn't this a placebo? i.e. the bulk of the app security comes from the fact that the application is relying on an operating system that provides a keychain and secure mechanism for this app, and only this app, to retrieve its secrets. Adding a 4 digit pin to supposedly hash your secrets and then secure them in keychain is what?