actually it's not a security measure per se... that's just Apple's line you're (unintentionally) towing there. The reason is simple - according to Apple itself, the fingerprint signature is stored in a secure part of the "processor", no the sensor itself. The sensor simply passes on a unique key, alongwith the fingerprint data (bits). It's the processor that receives this data and matches it to the signature stored in it's secure vault.
now even if someone were to put a (malicious) 3rd party sensor, what difference would it make? The sensor still has to pass on the fingerprint data, and the processor has to match it. If the sensor doesn't pass the correct fingerprint data, the phone cannot be locked in any case. The touch-id "key" is irrelevant as far as real security is concerned.
It's just like say, the camera they use at border crossings, and the image is compared to the one in the database. Even is someone install a malicious camera, the image it sends still has to be matched to the one in the database, which will fail it it's not the same person.
the only thing you can argue is if the sensor can be programmed to always send a known value, regardless of whose finger is on it. In that case, the malicious person has somehow already hacked the internal secure vault to get that data in the first place. specific to that phone, not generic in any case. The touch-id key, then, again, is meaningless.