I mean, it still seems sketchy to me, but it does sound at least somewhat plausible. The article also mentions that the two instances took place in opposite sides of the country (NYC and Miami).
It’s using what appeared to be a Pixel 3 with a heavy duty case wrapped around containing an additional camera and some sensors. I went through all of the poses one would do if they were training a model to perform similarly to FaceID. (Ok, now pull the phone out of your pocket and look directly at it. Look up at me then down at the phone, etc.)
None of it sounds like it would be.
Sound more like a cover story that some hackers/scammers would use.
The thing that is so frustrating to me about stories like this is that I don't know who to get angry at or complain about at parties. Google has become so massive it's clear that nobody is even aware of or in control of many of their activities, it's just a massive ball of opaque mud.