My one complaint, and the thing which forces me to use a competitor instead, is that there's no pin protection on entering the app, which I find quite unbelievable.
You can certainly turn on Face ID (and thus I assume Touch ID and passcode authentication too).
Personally I love that this is optional; I already authenticate securely with my phone, so it seems weird to mandatorily require an additional authentication step.
I can speak from experience about user perception of security, having previously run security product for a major UK fintech (which works with Monzo). A large proportion of users would complain that biometrics and/or PIN was not mandatory when opening the app. Many people share devices, especially iPads, or have family members that know their device passcode (or have a registered fingerprint or face).
Making it mandatory (or strongly pushing it) greatly increases the level of trust people have in your company. The data suggests it is a worthwhile convenience trade-off.
It sucks. Just to provide a bit of background on these kind of decisions: usually it's quite hard to support a plenitude of platforms, so what happens is that you end up supporting the most recent ones first: the ones that have strong authentication baked into the OS.
