At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN.

Regrettably, that's not often offered as a feature, even when the infrastructure is already there.