Aside from being able to disable Face ID by squeezing the side buttons, it apparently disables and requires a passcode after 2 failures (compared to 5 for Touch ID). It's not clear yet to me what counts as a failure, though: if someone gets the phone before you can squeeze it then holds it up to your face but you don't look at the phone (Face ID is said to "require your attention" to unlock), does that count as a failure?

EDIT: Apparently both Touch ID and Face ID disable after 5 failures — https://developer.apple.com/documentation/localauthenticatio...