I thought it was common knowledge that for privacy and security you should have FaceID (and before that, fingerprint reader) disabled in favour of a password.