The idea of FaceId is to minimize the use of a passcode so that wouldn’t be stolen in the first place. In if you worry about that, then probably disable faceid

The idea of FaceId is to minimize the use of a passcode so that wouldn’t be stolen in the first place. In if you worry about that, then probably disable faceid for banking apps :-) Apple also recently implemented optional stolen device protection in faceid settings just for this case: delay is introduced to be allowed to change the password and other related things.