Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police.
Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and culture in your particular environment (I guess ranging from "extremely unlikely" to "almost certain" depending on where you are).
Edit: I don't mean to disagree with your overall point that understanding the threat landscape and threat model is very important, just to say that there is a very simple and plausible threat to which the precaution you used as an example can be relevant.
Handy to know and easy enough to do discreetly in a pinch.
The author does have face unlock listed as "Advanced" priority. The wording is a bit weird but I take it to mean, only someone who has "very advanced" security concerns would need to follow that recommendation.
If I were going to recommend this to a friend/family member I would just tell them to stick to the basic priority items and not worry about the higher pieces.
I feel like this point misses the first point you made, about things being a lot more circumstantial and nuanced. It all depends on what you have to hide and on what device. Someone may need to go to the level of effort you mentioned to access someone's iPhone, while someone else may need to just print out a mugshot and hold it in front of a laptop webcam to unlock their computer.
Edit: I'll also second schoen's point about someone forcefully holding your own face up to the device.
List is "personal security checklist" so it also gives some context that you can infer "threat landscape", which I understand would be average Joe, not journalist, not a CEO, not a drug dealer, just normal employee having one bank account buying stuff online and going on vacations in his own country.
If you want to implement everything that is "optional" in your life it will be security larping.
But detaining someone and scanning their face is 100% allowed.