That sounds like expected behavior, but it's a good reminder that Stolen Device Protection can be a PITA sometimes. The whole purpose of Stolen Device Protection would be defeated if a thief was able to get in to set up Face ID for themselves.
Were you not home at the time this happened? If you're at a familiar location, it should let you use your passcode if Face ID isn't working. If you're not at a familiar location, then it should start a 1-hour security delay and show you a notification when you can get back into Settings to do what you wanted.
For familiar locations to work properly, make sure you have 'Significant Locations & Routes' enabled under Location Services > System Services. It'll take some time for the phone to build up some familiar locations if you're just turning it on or setting up a new phone.
Stolen Device Protection adds a layer of security when your iPhone is away from familiar locations, such as home or work.
support.apple.com