It's also far more likely for an attacker to have your photos upon which to build the authentication profile, than it is for them to have your fingerprint. App

It's also far more likely for an attacker to have your photos upon which to build the authentication profile, than it is for them to have your fingerprint. Apple is being misleading with that number, because it assumes an attacker would throw random photos/profiles at the iPhone X, not profiles that look very similar to you, which is far more likely to happen in practice.