Which is why it's nice that none of the biometric auths can be used without also having a PIN for backup auth. And also why it's nice that you can disable biometrics entirely.
The comment was aimed at the Snowden example. If Snowden thought his pin was compromised he could always change his pin, but once his face is compromised what does he doe?
not use faceID?
This entire article was explicitly written to address this line of thinking, and IMO does so very well.
That breaks both ways: only a fairly advanced attacker could "change their face" to access your phone. So Face ID still covers the 99% of cases Troy talks about. For the rest, I'm not sure a PIN works, either, so they'd have to use a password.
That's not true at all.
So you can change your face, and you can't change your PIN?
Surprisingly true with most end users I deal with.