Which is why, as I mentioned, you don't store the biometrics. You don't even send them to the remote service.
Hash + Salt on the client, submit the result. Unique salt for each remote service, and you can change it for a particular remote service if it turns out they do stupid shit with it.
If a password database is compromised, you have a problem, but you can change everyone's passwords.
If an iris database is compromised, you really have a problem.
Biometrics are also susceptible to replay attacks, where sort-of-alternatives (such as tokens) aren't.