So, I think you bring up some interesting points — all speculative, of course, as Jorge R said. However, the real question here is…will a thief think your data is worth accessing.
Can data be hacked on a phone with Face ID? I’m sure someone will figure out a way to do it. But is it going to be practical to do it?And is the data on the phone actually worth the effort?
Protecting your data is always a question of security vs. convenience, and I think for 90% of the population (or maybe more) Face ID will be just fine. If you’re doing some illicit stuff, or maybe you have big bank account information that’s available on your phone (which probably don’t actually make sense to store there in the first place since a phone can be lost), maybe following the security recommendations you provide make sense.