Most people fail to realize that they are constantly being recorded by one or more security cameras. Even without access to security footage, if someone is targeting you specifically, you will be recorded by long range high resolution high fps camera. Passwords are not secure anymore.
Face ID is the step in the right direction. It uses relatively strong biometric verification, and requires intention to unlock, which was Touch ID weak point. With Touch ID, anyone can use your finger to unlock without your consent. With Face ID, torture is mandatory. There is no way to force a person to look at the camera if he doesn't want to.
On the second thought, in theory, they could knock you out, glue your eyelids to keep your eyes open, and use needles to position your eyeballs for unlock.