Matthew Panzarino has a great interview with Apple VP Craig Federighi, well worth reading. Bottom line:
The fact of the matter is that there is likely an outsized amount of skepticism about Face ID because other manufacturers like Samsung have shipped versions of facial recognition that are, frankly, crap. If it can be fooled by a simple photo, what the hell are you doing shipping it at all?
Face ID is not a simple image recognition system. It looks at a three-dimensional model of your entire face, recognizing features at a level of detail high enough that Apple is confident that masks will not fool it. It’s a different ballgame entirely.
The rewards for making security (a passcode) incredibly easy for people to implement and use on a daily basis are enormous. The vast majority of people still use common passwords and don’t enable two-factor authentication on any of their devices. The amount of work that Touch ID has done and Face ID will do to improve the security of regular users is huge.
You can safely ignore all of the hot takes coming out on Face ID -- that Apple stores a picture of your face, that it won't work, that you can fool it easily, etc -- it's all garbage. This is a game-changer for individual privacy and security.