Aside from being able to disable Face ID by squeezing the side buttons, it apparently disables and requires a passcode after 2 failures (compared to 5 for Touch ID). It's not clear yet to me what counts as a failure, though: if someone gets the phone before you can squeeze it then holds it up to your face but you don't look at the phone (Face ID is said to "require your attention" to unlock), does that count as a failure?

EDIT: Apparently both Touch ID and Face ID disable after 5 failures — https://developer.apple.com/documentation/localauthenticatio...

The article said you'll be able to use the new method (hold sleep/wake and volume button for 5 seconds to require a passcode to unlock – i.e. disabling face/touch id).

Thank you! Figured I had missed it skim reading on mobile :)