Yes, facial recognition is still far from being good enough for authentication. It’s one thing if an algorithm tags you in somebody else’s photo; quite another if they accidentally let the wrong person get access to your personal account.
I actually didn’t think of 3D printing, but, now that you mention it, that seems an obvious way to fool the system.
Maybe we can design our system to reject faces that are not connected to a body. Maybe people will start printing out masks, pretending to be others. As fast as people develop stronger systems, so others will be working to break them.
I guess the main question is: who will get there first?