That breaks both ways: only a fairly advanced attacker could "change their face" to access your phone. So Face ID still covers the 99% of cases Troy talks about

That breaks both ways: only a fairly advanced attacker could "change their face" to access your phone. So Face ID still covers the 99% of cases Troy talks about. For the rest, I'm not sure a PIN works, either, so they'd have to use a password.