Facial recognition has a long history of attacks, poorly designed implementations, and abuses. You can avoid every one of those problems (past, current, and future) by just not using it. It doesn't matter if you've got a cheap cell phone or the newest thing off the line, attacks will evolve as technology patches up old problems. Sources and links to more detailed info isn't a bad idea, but specific examples will be outdated much more quickly than the general advice will remain relevant.
The alternative is a pin that anyone can watch you type in. “gain access to the device, through digital photos and reconstructions from CCTV footage” is a hell of a lot harder than reconstructing a pin from CCTV footage ;)
> The alternative is a pin that anyone can watch you type in.
If they're standing directly over your shoulder sure, but you show your face to far more people. You may also be able to have your phone scramble the order of the numbers to make it harder for people to know your pin, or use gestures to unlock your device. You can also reset you pin far easier than you can reset your face.
face recognition can work even if you're asleep, unconscious, or dead too, but nobody can ask you for a pin in that situation.
