As long as it's a proper implementation of a face unlock. When the iPhone X came out, OnePlus was quick to jump on the bandwagon and start advertising their new face unlock, which was completely reliant on the front-facing camera.

Which tells you it can be tricked with just the IR picture.

Mind explaining what an IR picture is?

Facial Unlocking isn't just using image recognition. Face ID, specifically, using point mapping across a face, creating a 3D map of the face and reference points to unlock the device. I don't think a flat 2D image, even with IR photography, could trick a system like this.

A Hollywood grade prop mask of someone's face might be able to trick it, but that seems like a huge outlier.

Even a hollywood mask wouldn't trick it unless it had some way to simulate the temperatures across the face. IR determines the points and the relative temperature to make sure the face is live.

I mean that it is not including features from the visible spectrum when making its decision, only IR & time of flight (depth). IR makes it easy to track the eyes (basically all eye tracking systems use IR) but misses skin tone cues.

A prop mask is one approach, but adversarial machine learning techniques might be even more effective, especially if you can study the adaption to a particular face.