You can fool a human with makeup and prosthetics coupled with other fake ids.

This exploit isn’t practical as it requires 3D scanning the victim’s face. Similarly the touchID exploit isn’t practical so no one cares.

This method is much more secure than passwords that also get exploited by cameras or just brute forcing the 20% of pass codes that are “00000.”