bit of a face unlock novice, isn't all just selfie camera and software, or is there more hardware going on ?
FaceID on iPhones uses dedicated hardware to make a proper 3D image map of your face, is very secure and can't be fooled by a photo. The equivalent on most Androids is more or less what you said and in many cases can be cheated by a photo. Google came up with their own 'proper' version of FaceID but dropped it in a year. Because they are Google.