Hi @Based
Thanks for the feedback. We are aware of this issue, but there is a little more complexity to it. See this explanation by @bjoern on why we currently do not ask for the PIN: Discourage user verification by Dfinity-Bjoern · Pull Request #311 · dfinity/internet-identity · GitHub.
As for the implementation of proper checking of authenticatorData, the most up to date resource is this topic: Internet Identity Roadmap Update, June 2022
The issue is called “FIDO2 User Verification”.