OK, so without checking through your maths, what you've discovered is if we take a generous x10 increase in power over an example IR range finder, then it is still 1/10th of the flux that could cause damage if someone were to implement a completely ridiculous use-case of rapidly and repeatedly locking and unlocking their phone as fast as they can, sustained for over 15 minutes.
Some near IR can reach the retina. We don't know what wavelength is used for Face ID. In this case, it's best to go by standard laser safety numbers, i.e. the limit for Class 1 lasers (which are 100% eye-safe) is 1 mW. So depending on the size of your pupil, IR flux of over 1 mW/cm^2 would still be retina safe. Depending on the wavelength used, the safe-level would rapidly increase as wavelength increases. So again, not even close to dangerous.
EDIT: Additionally, FaceID is probably pulsed, further lowering the average IR flux.