Apple could just add an optional “face mask mode” to FaceID which performs recognition of just the eyes plus facial features above the nose with a disclaimer that is a less secure. A user would have to manually select it and accept the risks. After all, an extremely weak 4-6 digit pin (which can unlock all the data on your phone) is what most people use anyway. The PIN is orders of magnitude less secure than a upper face FaceID (I can guess what most people’s PIN is just by looking at the smudges on their screen corresponding to the numbers)