The stores would have to deploy special-purpose IR cameras to collect the kind of data FaceID uses. And even with that data it’s unclear how it could be used to

The stores would have to deploy special-purpose IR cameras to collect the kind of data FaceID uses. And even with that data it’s unclear how it could be used to present a false image to a phone. The hacker pulling this off would also need physical access to your phone. From a security perspective it would be a lot easier to collect a fingerprint and use known methods to create a false fingerprint that a phone would recognize. So if you’re worried about this kind of thing, FaceID is preferable.