This raises a major question though - what's the use case and threat model for facial recognition? If you're remotely concerned about security, clearly you're not going to use it. If you only care about preventing the casual attacker, either option seems good enough.

I just don't see a security model in which Apple has substantially improved it. The security of it is terrible in either case - all Apple did was make it more expensive.