Hmm I wonder if it is gaze detection. Seems like if you can detect gaze direction fast enough you could use the presence or absence of saccades to tell if it's a real live person or not. Doing that in a mask/bust would be fairly difficult.

It could also be looking at small changes like the periodic flushing that happens (see [0]). Though I'm not sure how well that would work on a moving phone but it could work I think just at a broader scale. FaceID is really fast though so not certain there's enough time to gather the data for that either.

[0] http://people.csail.mit.edu/mrub/vidmag/