Keystroke dynamics is indeed a form of biometric recognition that has been studied for a long time. It was already known in the telegraph era: skilled operators could recognize each other's “fist”, similar to recognizing someone's handwriting.
As far as I know, this is not precise enough to authenticate someone. A 2005 study by Araújo et al. results in a 96.34% success rate (3.66% false acceptance) in a controlled experiment, for an imposter, for typing the same user-chosen string 10 times (see §IV.B). The false acceptance rate for a hard-to-type password is likely to be worse. It can be used as a second authentication factor, but as an authentication factor, it's pretty weak.
These days, a lot of authentication is performed remotely, with the typing device under control of the unauthenticated user, who may be the attacker. This means that keystroke dynamics is not reliable in this setting.
Keystroke dynamic is sometimes used, not as a primary authentication factor, but to raise alerts when an account might have been compromised. On its own, it has poor signal, since a user with unusual typing patterns may be wounded, tired, using an unfamiliar keyboard, etc. It can be useful in combination with other factors however.