"What if I just generate faces with AI and use them? How could a system prevent that?"

There are techniques to detect movement etc.

"I wouldn't feel comfortable with a hash of my face on a public server. Even if it's just a hash."

All central servers already have not only your data but also monitor your habits daily and you are fine with that because you simply don't know it.