“One functionality that still requires manually typing a password is using sudo from command line.”
The fix is one line in /etc/pam.d/sudo. Apple shipped the fingerprint reader and the PAM module, then left them switched off for the terminal. It took a blog post to tell Mac developers their laptop already does this. Hundreds of upvotes for a setting Apple could have flipped by default.