In theory the biometric data lives in a special part of the phone hardware that the software can't (generally) access. It's one of the big deals about phone biometrics - it should be really hard to leak.

AFAIU, the fingerprint stored on the phone is incredibly low quality, so I'm not sure how much value it would have.

Could they mess with that? Yes. Is there profit in getting a really low quality hash of every user's fingerprint? Probably not worth the hassle.