A Keychain item is added with an insecure always-accessible protection class.
Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly or add SecAccessControl with biometrics.