A retina pattern is a simplistic and static thing - the very reason it was chosen as a candidate for an ID technology once. The unfortunate consequence is that it's fairly easy to forge, too. You can't teach a retina any tricks; just taking a photograph and showing that to the ID machine will work nicely, as the machine has no means of further "interrogating" the retina.
In contrast, a voiceprint at least can be subjected to interrogation. Say, anybody could record Picard saying "I am Captain Jean-Luc Picard" and then play that recording to the ID machine. This is indeed how the "Maquis" (in reality, Cardassian) operative in "Tribunal" fools a door lock aboard DS9. But it's statistically highly unlikely that Picard would ever utter the phrase "Picard, Jean-Luc, Tango Cedar Alpha Twenty", so such a phrase works admirably as a means of identification. There is no need for the phrase to pass muster as a "password", in terms of complexity; there isn't even any need to change the phrase at regular or irregular intervals. It just suffices that this phrase never arise in normal conversation.
You will notice that Star Trek uses aliens and androids and computers and stuff. Starfleet should and would take that into consideration.
Indeed - which is why retina scans and the like are a bad idea, and something more complex and trustworthy, such as a voiceprint, should be preferred. Any stupid machine can photograph a retina, even from a distance (unless the heroes routinely wear shades or something equally idiotic). Goading Picard to utter a code phrase and recording that is a far more complex feat.
It also won't do to make the ID procedure overtly complex. People need to get their IDs confirmed in a hurry; it can't be a six-step process. You pick your best ID technique and stick to that.
Cardassians have it right, though, in using the superb 24th century technology for implementing an ID scan that works at a distance, without the target even knowing he's being scrutinized. Scanning for DNA at a distance solves most security problems: it's unique enough (yes, in TNG, you can alter your DNA, but supposedly you then cease to be you in most respects that count), it's all over you (so wearing a false thumbprint or a false retina doesn't help), and you can easily use the technique to unobtrusively collect a library of IDs (which current fingerprinting techniques don't allow for).
Timo Saloniemi