In theory, 3rd party apps can just save the credentials in the keychain. The data in the keychain are encrypted, and can only be decrypted with correct PIN code or Touch ID. Unfortunately there doesn't seem to be an API for 3rd party apps to detect whether a device has PIN code enabled (there's certainly some private API for that), but apps can still provide the usual "save my password" tick box.