The photo on the card is already stored in a system somewhere, and already vulnerable to attack. The brain is just for authentication at the door.