I think it can be assumed that the facial recognition is rate-limited, just like PIN entries. Even if you had a million phones and a million faces in your database, you could only try perhaps 30 faces on each phone.
If you have the kind of surveillance tech people are postulating here, you already have a high-res-enough scan of the actual face of the person you target in order to produce something to unlock their phone.
Not likely - they used professional hollywood mask makers to test against... Remember, this is infrared with a 30k dot projector - the most accurate 3d visual record you could make would appear to be insufficient.
