They do use it but you can force passcode requirement by holding down the power button until 'slide to power off' appears. From daringfireball: '(One way the scam would run: Chat up the victim in a bar, and offer to use the target’s phone to snap a photo of the victim and their friends. Surreptitiously lock the phone out of Face ID when handing it back to the victim. Then, when next the victim wants to do anything on their phone, they need to enter their passcode. Either the thief or a partner in a team gleans the passcode. Then they steal the phone, knowing the device passcode.)'

masks? sunglasses? etc

But also the phone locks back to requiring a passcode with enough failed attempts, so presumably people stealing them know how to induce recognition failure.

It’s very easy to trigger the fall back to enter PIN code.

If anyone is interested, I wrote a small utility to time-lock data, to be able to self-restrict myself in terms of Screen Time etc. passwords: https://github.com/aerbil313/timelock

Say that to BofA. On my phone they still require email or text when I sign in.

Guess what I receive on this iPhone? Right, email & text.

On my PC it prompts for my YubiKey, but I cannot use it on iOS.