It learns your face and can work around haircuts, sunglasses etc.

Well but that's the exact point - if it can work with sunglasses on,then it means you can force it to ignore whether someone is looking at it or not. Put sunglasses on someone unwilling to look at the phone - bam,done, phone unlocks without a problem.

How does it work around sunglasses if Apple also said you have to have your eyes open?

Just a guess: it uses infrared to somehow determine where you are looking, and sunglasses don't block infrared.

If this is true, then require looking directly into the camera is useless. Border agent could simply put a pair of sunglasses on you and unlock your phone easily.