They fixed this a few versions ago. Now if it sees a mask, it shows the passcode input immediately.
If I have a mask on, swiping up immediately brings up the pass code screen. In this case immediately is <0.5 secs.
FWIW I have a new Apple Watch and have this issue. I just installed the update so I haven't tested the Watch authentication. If it can't detect a mask I'll have the same issue as before waiting for a number pad.
What exactly is the reason/rationale that it has to fail on facial recognition first before proceeding to use passcode?
C O U R A G E
Joke aside, it seems that Face ID was a tremendous technical effort so you could have instant access to your phone. Besides unlocking, there's no other serious application (memojis aside). The fingerprint reader was probably removed just to prop acceptance of Face ID. Also, Face ID is less secure. If you're detained or mugged, just looking at your phone will unlock it before you can react and look away.
IMO, the 3D scanner should be on the other side, enhancing your pictures with 3D depth.
By the "they can just use violence" logic, no computer is secure and we should throw them all into the ocean. Security can improve the intermediate cases- focusing solely on the worst case is unproductive.
As far as hypothetical situations go, I prefer this over them cutting off my finger.
More seriously, in a situation where I'm detained or mugged, there will be a lot of external factors which are pushing me to unlock my phone, be it via passcode or biometrics.
FWIW, "SOS mode" (holding the power and volume up buttons) will purge information needed for biometrics to work and mandate a PIN on both TouchID and FaceID devices.
That's what the LIDAR sensor on the latest phones is for. It only gets used in photos for the portrait-mode stuff, admittedly.
Portrait mode is Apple-speak for pseudo-depth-of-field, which is the effect that real cameras do that make the subject in focus but the background blurry.
It makes photos look way more professional.
Much easier to force someone to unlock the phone with their fingerprint than to force them to unlock with faceid if you have “Require attention” on.
You can’t physically force someone to look in a certain direction, but you definitely can force them to tap their finger on a surface.
Excuse me, but this is ridiculously easier than forcing someone to use their fingerprint; just wait until they are distracted, show them the phone and ask them "what is this?". It unlocks in less than a second with "Require Attention" activated. We prank each other this way when we forget our phones around the house.
* If you're concerned about someone who can see you typing, a biometric is better because they have far fewer chances to watch you — especially if you don't reboot outside of your home.
* If you're concerned about actual adoption, a biometric is better because you remove the constant frictional password entry cost which causes a large fraction of users to use short, easily-entered passwords.
* If you're concerned about someone who has enough access to construct a usable fingerprint / face facsimile but can't coerce you into providing a password or shoulder-surf it with a drone, a long password is better.
To better train the facial recognition system, perhaps.
If a mask is on the tip of my nose and loose fitting, it seems to work.