To say that a boarding pass is “something you have” in a security sense is absurd. I can print your boarding pass merely by knowing your name and where you’re going. A biometric check (backed by a paper ID check) is a dramatic security upgrade over that.
Passports are printed similar to currency. There are many features in them that are hard to replicate. It can be done but not easily, so it does fit the bill of "something you have" to authenticate. Not nearly as secure as a yubikey or an rsa token, but oh well.
You’re right, a biometric check with a passport check is in fact more secure. But what they’ve done here is replace the passport check with a biometric check.
