You could very quickly rule out 95% of the field with little effort, and people already do things like say "you look so much like X": we have a short list of collisions already.
But at least it's not like people have pictures of their faces plastered across every social network...
... crap.
But I also don't think the "brother who already knows the phone PIN code" a real world attack vector of concern to most people. I get that it could be an issue in narrow situations: you share your pin code, lookalike sibling uses it to "train" your phone; you change passcode not realizing that phone will still unlock for now-untrusted sibling.
Even in that scenario, I would bet that after a few days of normal usage by the phone's rightful owner alone the attack wouldn't work anymore. But, it's too soon to know.