"not that hard" to whom? A state operator doing a targeted attack, most likely not.

Local police? No fucking way. Random phone thief? Don't make me laugh.

And people seem to actively "forget" that this is a learning model, getting better with every unlock. Just like TouchID, but better.

They talked about how masks can't fool it, so I'd expect that a 3D model won't either.

Of course it's easy. But it's a severe threat model. Targeted physical attacks aren't really on the list of concerns for most people. And if you are worried about it, you shouldn't be using touch or voice unlock either.

Presumable the IR sensor will know that your photo or replica is not body temperature. That said, maybe heating up your fake with a hair dryer will work?