The researchers concede, however, that their technique would require a detailed measurement or digital scan of a the face of the target iPhone's owner. That puts their spoofing method in the realm of highly targeted espionage, rather than the sort of run-of-the-mill hacking most iPhone X owners might face.
Yes, if you have precise enough tools and can print a face that resembles the owner's, and you wear that face, you're going to 'bypass' the recognition software, but are you really 'breaking' it?
You can really see the researcher playing hard to the validity and value of the work here;
Bkav, meanwhile, didn't mince words in its blog post and FAQ on the research. "Apple has done this not so well," writes the company. "Face ID can be fooled by mask, which means it is not an effective security measure."
I don't know, it's not 'hacking' or even 'breaking' enough to concern me.