> These can be used pretty easily to create a fake finger that would probably fool the sensor.
At this point aren't all bets off? If a person is willing to do that, I would think they'd also be willing to disassemble the phone and extract the information that way. You would need a sort of whole-disk encryption too.
Main problem with any kind of biometric authentication is that it cannot be used as basis for generating encryption keys (eg. for whole disk encryption). Because in that case it's totally irrelevant if you can fool the sensor, you just have to process somehow "stolen" biometric data in same way as the sensor (+ encryption software) does.
For other authentication applications, all security lies in fact that it's not possible (for reasonable values of "possible") to fool the sensor or bypass it. But most commonly used fingerprint scanners are incredibly easy to fool (even including so called "high-security" sensors that happily accept photocopy of fingerprint as valid finger). Bypassing the sensor is often even easier, but on the other hand I've seen systems (for example BIOS level fingerprint authentication on ThinkPads) that are explicitly designed as to make that very expensive (in the ThinkPad case you would have to actually decapsulate the sensor chip from it's package).
At this point aren't all bets off? If a person is willing to do that, I would think they'd also be willing to disassemble the phone and extract the information that way. You would need a sort of whole-disk encryption too.