They scan your eyes and make sure you're actually looking at it to prevent exactly that attack. The problem with it is twins, or even people who's faces are similar enough (mother/daughter or sisters) can be enough to unlock.