Touch ID and Face ID are proxies for your passcode or password, and those allow you to use a more secure passcode or password, without having to enter the passcode or password as often.
Touch ID and Face ID are only a proxy for the passcode or password, and it is the passcode or password that secures your data and not Touch ID or Face ID.
The passcode or password is used and kept locally on the device, or very occasionally used to authenticate directly-connected computers; to enable the iPhone or iPad to trust the connected computer.
The passcode or password is not used for remote access.
If somebody else knows or can guess your Apple ID password (such as if you’ve unfortunately re-used passwords across different services), it’s game over for all computers and all devices associated with that Apple ID. Devices can be remote;y wiped, data can be changed, etc.
The Apple ID password is distinct from and separate from the iPhone and iPad passcode.
If you think your Apple ID has been compromised - Apple Support
As for tracking your location and activities, you’re on a cellphone, and all cellphones can inherently and fundamentally be tracked. Both from apps in use on the particular cellphone device, and tracked from the cellular network towers.
If this is a particular concern of yours, contact your elected representatives, and discuss this with them. While there’s nothing that can reasonably be done with carrier tracking as that’s inherent in how communications networks and cellular and Wi-Fi and Bluetooth communications work, the associated data can (potentially) be legally protected.