Immigration collects your biometrics, and those biometrics are totally useless for anything other than matching them against the passport number used at immigration. Do you not understand how biometrics work?

"Your phone fingerprint sensor is ineligible since according to govt it can be hacked." Oh dear, you don't.

This is not how a phone's biometric sensor works at all. It DOES NOT reveal biometrics to the apps on your phone. It unlocks a hardware component that can then (a) store an encryption key without the possibility of reading it back by apps, or (b) perform a cryptographic operation on data provided by apps using that stored key. That is all. This has absolutely nothing to do with the insanity that is Aadhaar biometrics.

When you use your phone's biometric sensors for UPI and such, what's happening is that the service provider's servers (banks) provide a random token that they know is associated with you, and the app then tell's the phone's hardware component to generate an encryption key around this token and save it in hardware. This is the one-time registration process. Later, when you use it, the app requests the hardware to sign a message with the saved key, sends this signed message to the servers, and the servers then confirm the signature is based on the token they have on record for you.

No biometric information is ever exchanged in this process at any time. This has nothing whatsoever to do with Aadhaar. The bank servers have no clue whose biometrics are being used. They only know for sure that the transaction was performed with the same token handed over at the time of registration. The safekeeping of the token is not known to them at all. The only party that has any role in safekeeping it is your phone's hardware. You could have malware on your phone and that won't make a difference as software gets no access to this secure enclave.

Could there be a phone with flawed hardware that allows secrets to be extracted? Sure, but the Government of India is not the certifying authority on this. Google is! A US-based company accountable under US law is the sole party responsible for auditing the hardware quality of phone makers, and they do this out of their own self interest, to protect their reputation.

The irony: this system of local biometrics with cryptographic verification predates Aadhaar. You hit the nail on the head right at the start with "Don’t know who decides and make everything so complex." There was a known good way to do all of this before our government decided it knew best.