I wish that Apple would make a way to require both FaceID and a passcode. This seems like an easy option to add.
The touch + passcode is nice because even if someone watches you enter your passcode it won't matter unless they can spoof the fingerprint reader too, which is highly unlikely. And you can use a much shorter passcode for convenience.