>Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.

I feel like this point misses the first point you made, about things being a lot more circumstantial and nuanced. It all depends on what you have to hide and on what device. Someone may need to go to the level of effort you mentioned to access someone's iPhone, while someone else may need to just print out a mugshot and hold it in front of a laptop webcam to unlock their computer.

Edit: I'll also second schoen's point about someone forcefully holding your own face up to the device.