That paragraph is a bit misleading/unclear in my opinion, and is further explained lower in the article. Basically the Clear enrollment process is this:

1. First, the prospective enrollee needs to be matched to their ID. The normal way to do this is to take the person's picture, and then facial recognition software matches that face with their ID. However, since facial recognition isn't perfect, there is a "manual override" process where a Clear employee manually checks your ID and says "yes, this is you." That's why I don't think the sentence about "Enrollment photos seen by Bloomberg in some cases didn’t show a face at all and instead, for example, a shoulder and ceiling" is really that big a deal, because in those cases the photo was just ignored, and the person's ID was manually verified (which is what TSA agents do anyways).

2. Once your ID has been verified, then the Clear system scans your retina and your fingerprints. For any flights then that you want to board, Clear just does a retina scan to look up your ID.

The problem is that if the original ID verification is wrong (e.g. the applicant had someone else's ID that just happens to look similar to them, think of the 20 year old trying to get into the bar with their older sibling's ID), it basically would allow the person to fly unlimited without their ID ever being checked again. That is, you only need to "sneak in" once.

I think a better solution is to just more periodically revalidate IDs, and pick some percentage for random additional verification.