I think there are two separate questions being raised. My understanding (EDIT: my understanding of the concern being raised in this discussion) was not that they would try to recover individual readings from a trained model, but that they would run a model on your face to extract features, then save an array of features that defines your face. Only those features are needed to identify your face - after data extraction the photo is no longer needed.

This article talks about how those data points are extracted using a different method.

https://medium.com/@ageitgey/machine-learning-is-fun-part-4-...