Personally, I think it would be a cool possibility to require BOTH faceid and touchid. I would not use it, but having the possibility is neat. I love faceid, and hope it only keeps getting better. The combo would have to make the most ardent defenders of privacy happy, no?
Thing is, with both there is no reason to not use both. You shouldn't have to scan your face and your thumb to unlock your phone. The one that makes most sense in the current situation should be good enough. Ex. you pick up your phone without touching the screen and the screen wakes up. Face ID triggers and you are in. Or you have it on your table and tap to wake the screen, Touch ID will handle it this time and you have unlocked your device. In a situation where Face ID fails, just tapping something on the display will then unlock with Touch ID.
It should be seamless to the user and you shouldn't even be thinking about that you have to unlock your phone. It's just aways "unlocked" to you.
It could even work the other way around. Someone takes your phone and starts using it, during use Touch ID senses something is wrong and initiates a Face ID scan. Both verify it isn't you and the device locks. This could be user configurable of course as sometimes you want to hand your device to someone else