A few thoughts:

Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital.

This is contrasted to Samsung and Microsoft's solutions which take a picture and try to match it.

Apple's Platform Security Guide on Face & Touch ID [0] is an interesting read.

[0]: https://support.apple.com/en-gb/guide/security/sec067eb0c9e/...

Microsoft's solution requires an (near) infrared camera and will not accept a regular USB camera, though. But it does seem to rely on simple facial recognition rather than building a depth map. The main use of the near infrared seems to be to work around lighting issues and simple spoofing though.

https://docs.microsoft.com/en-us/windows-hardware/design/dev...

iPhone X(box Kinect)

Still nowhere near as secure as they make out though

What vulnerabilities are you referring to?

If you have relatives that look like you the chance goes down from one in a million. And they're also the most likely people to have access to your phone, and by interested in what's on it.

Also the younger you are the less likely it is to differentiate.