Earlier quoted context omitted.
It _always_ depends on your threat model. Most people need protection from snooping family members, or people who find your phone if you lose it. For these use cases Face/Touch ID both work great. If you are trying to secure your data from the NSA, well you have probably already lost, but by all means, turn off Face ID.
How do you protect against family members who have enough pictures of you to create a 3D printed model of your head [1]? [1]: https://www.wired.co.uk/article/hackers-trick-apple-iphone-x...
Given how sensitive FaceID is I don't think this is a realistic bypass approach. Not that it was even confirmed anyway.