It's just an app update like when fingerprint support was added. No reason iris can't be used in place since iris is as unique as fingerprint but can't easily be lifted.
Don't know if S8 face unlock that was demoed is final but when implemented like Windows Hello with IR it's picture resistant and on par with fingerprint-only that has been bypassed by 6 year old child.
http://insider.foxnews.com/2016/12/28/child-unlocks-sleeping-mom-iphone-using-thumb
High security access usually require MFA verifying who you are (via eye scan), what you have (token/badge) and what you know (pin/password). Personally I wouldn't use fingerprint alone or IR face unlock alone for anything requiring high security and would require a minimum of MFA iris + IR face unlock for hands-free convenience for lower level security and MFA iris + IR face unlock + pin with rotating pad (so it can't be reversed looking at screen smudge). Fingerprint is outdated since it leaves a print that can be lifted.
I don't know if that's a fair comparison. That kid physically put his moms finger on the fp sensor. Something equivalent would be holding someones face in front of their phone, not the same thing as a picture.
You make good points about security though. fp sensor isn't really that secure, and it also doesn't stop LE from forcing you to open the phone if you are worried about that sort of thing. I believe Apple's method is safer though, how they incorporate fp authentication in apps for example. I definitely don't trust Google or Samsung to do the right thing.