> I don't think an apple watch would help there?

You can authorize via Apple Watch everything you can authorize via Touch ID. You get the notification on the Watch, and you need to press the button twice to auth.

I don't remember if it works every time, or only when MacBook is closed and connected to external display/keyboard.

Wait, one can wire up sudo to touch ID? I don't know how I never learned that before

I've got this functionality in linux with the framework laptop, and it really isn't much faster than typing in a password.