FaceID can handle 2 faces. Let's say I decide to give my child one of those slots so they can play on my phone. Do I really want a 5 year old deciding to install an update? Probably not. Or the other face belongs to my wife. Again, I wouldn't want her to install an update on my phone without my knowledge.
My boys are actually 17 and 22 and have their own devices and I don't let ANYONE else into my phone. But it's a possibility that ought to be considered. Especially with the older TouchID system where you could in theory have 4 other people who could unlock your phone.
The other explanation I've heard is that your passcode is your security. FaceID is a quick and easy way to bypass that security. It's a biometric convenience, not the actual security itself. Which is why you need to enter your passcode after a reboot or when doing something as important as updating the entire OS.
There's some (possibly) lame excuses that may or may not satisfy your curiosity. Honestly, it's a question I've asked myself and I all I could come up with was "extra security". Like asking "Are you sure?" before deleting a file.
It's not for two different faces, it's for alternative appearance. So you're doing it wrong.