It's about your data. If they can get into your financial apps and transfer funds for instance, that's worth a lot more. Or even pay for products using your saved credit card or Apple Pay information.
The thing with the mask is...someone has to have access to making a 3D mask of your face, and have time to train the Face ID to the mask (i.e. input passcodes when it fails). I am not sure why most would bother with this when they can just call your elderly grandma and ask her to buy itunes cards for them, or send them bank info so they can deposit $5,000,000 from Nigeria.
Much more efficient to hold a gun to your head and have you unlock with Face ID, Touch ID, or a passcode.
Even if someone stole your phone and hauled around a mask to use Apple Pay or enter all your apps, you can use Find My iPhone and lock it. Or, you know, call your bank and lock down your accounts and cards.
So yeah, I am not worried about this scenario at all.
Last edited: