I default to skepticism on this sort of explanation, especially when it involves Apple and third-party repair.

Of course, it might be possible to devise a very sophisticated attack using the screen's hardware interface and Face ID as a vector. If the iPhone was a security-hardened specialty device, I might find that to be a valid reason. It isn't; it's a consumer device, and one that's not terribly hard for sophisticated attackers to compromise, e.g. https://www.wired.com/story/apple-imessage-zero-click-hacks/