This is correct. The fingerprint scanner and/or FaceID datasets are all stored and processed locally on device.

Though, if you've ever flown internationally you've likely had to get your photo taken. This isn't just a normal photo, it's capturing the topography of your face (like FaceID). That's pretty scary in itself that the TSA or other country's border patrol keeps this data.

But, scanning iris is even worse as it's one of the more accurate ways to identify people. I wouldn't want to give it up freely to a company who created the problem in the first place that they're supposedly trying to solve.