FaceID has an attention aware feature, if you don’t make eye contact with camera it won’t unlock, you can’t just hold it up to someones face and unlock it.
As for security, there is nothing more secure than a 6+ digit alpha numeric code as you state, but that is as long as you can 100% hide the input, which is hard to do standing in a line in a retail store.
It would also take a lot longer than authenticating payment with a fingerprint or facescan.
And in the off chance that someone pulls a gun on me demanding that I give them my phone, they better fire a deadly first shot, or they’ll end up with a broken windpipe.
To sum it up, I don’t share your concerns, bring on the FaceID