Of course it's easy. But it's a severe threat model. Targeted physical attacks aren't really on the list of concerns for most people. And if you are worried about it, you shouldn't be using touch or voice unlock either.
Targeted physical attacks are a bigger concern than people often assume - think abusive relationships.
It sounds like this in some ways is a step forward from touch id in that regard, but we'll have to see.
Presumable the IR sensor will know that your photo or replica is not body temperature. That said, maybe heating up your fake with a hair dryer will work?