"Once it confirms the presence of an attentive face, the TrueDepth camera projects and reads over 30,000 infrared dots to form a depth map of the face, along with a 2D infrared image. [..] To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. [..] the A11 Bionic chip [..] transforms this data into a mathematical representation and compares that representation to the enrolled facial data."So it matches on a math model created using face data and 'a device-specific random pattern'. So unless someone cracks the algorithms used here, you need the device data to spoof the model, assuming the pattern is used in a way that you can't simply ignore it and generate matching models using just a spoofed face.
"We worked with participants from around the world to include a representative group of people accounting for gender, age, ethnicity, and other factors."
If the model is really hugely inclusive, it could be too general. But also it would be very difficult to get the same number of scans from some minority populations, and that could affect the functionality of the result.
"An additional neural network that’s trained to spot and
resist spoofing defends against attempts to unlock your phone with photos or masks."
Gruesome thought: what if somebody obtained your face?
Additional thought: could we train the neural network to detect faces under duress and immediately lock the device?