Yeah, "they" probably simply have our FaceID data that we're willingly collecting ourselves, supposedly for our own security.