I suspect this is actually something to do with the fact that the Face ID sensors are projecting unique patterns across different devices. From the Apple Platform Security document:

> After the TrueDepth camera confirms the presence of an attentive face, it projects and reads thousands of infrared dots to form a depth map of the face along with a 2D infrared image. This data is used to create a sequence of 2D images and depth maps which are digitally signed and sent to the Secure Enclave. To counter both digital and physical spoofs, the TrueDepth camera randomises the sequence of 2D images and depth map captures and projects a device-specific random pattern. A portion of the Secure Neural Engine — protected within the Secure Enclave — transforms this data into a mathematical representation and compares that representation with the enrolled facial data. This enrolled facial data is itself a mathematical representation of the user’s face captured across a variety of poses.

https://support.apple.com/en-gb/guide/security/sec067eb0c9e/...

The back end has to be able to trust the data from the sensor, and the only way to do that is engineer them as part of the same cryptographic trust domain. Otherwise you could just swap the sensor for a dummy device that presents whatever data you like to the back end. That would completely break the security model.

I know a lot of the other phone manufacturers do stuff like this and think it's ok, but Apple knows what it's doing.

How can you trust that the sensor is actually delivering what it sees?