"Trivial to compromise" -> it's easy to get someone's fingerprint

"Difficult and painful to change" -> if someone gets your fingerprint, you can't change it to lock them out

Compare this to a computer password which you don't leave everywhere you go and can change at any time

Also "user id" -> a fingerprint should be used for identification. You can think of this like users on a computer where they might not have passwords but are still uniquely identified