It’s really precise 3D with a greyscale non-thermal IR image. Could be inaccurate masks? Missing details around the eyes and mouth and other important areas? Do masks have eyes with a discernable gaze direction? Do they have microexpressions or natural facial deformation? Do the eyes move?
There’s a buttload of stuff they could be measuring that is insanely hard to replicate with a mask. Besides, a thermal map would be pretty much useless even if the hardware was capable of thermal imaging. Skin temperature varies a lot (and not always uniformly) based on ambient conditions, physical exertion, being sick, sitting in direct sunlight, etc, etc.
It could also be looking at small changes like the periodic flushing that happens (see [0]). Though I'm not sure how well that would work on a moving phone but it could work I think just at a broader scale. FaceID is really fast though so not certain there's enough time to gather the data for that either.