Do devices with a fingerprint scanner secure access to the bootloader/recovery

In answer to your first question, I'd say yes. If there was a serious error with the fingerprint sensor hardware or a glitch with the software, you'd need to somehow recover your device. And if something isn't working, then where are you left?

And in answer to the second question - the fingerprint software is pretty high-level and out of fastboot's (the general Android bootloader. Samsung use another one, called Odin) control really, however I guess it could be implemented if it's necessary. However, it would also be unnecessarily complicated to implement this in the bootloader, and would require quite a lot of communication between both fastboot and the Android system whenever the device gets turned on to make sure both software layers use the same fingerprints, etc.

I do see your point with protecting recovery with a fingerprint - TWRP is Linux based and so could theoretically support it, but then someone could simply overwrite it with a stock recovery image.