Biometrics aren't secrets. It seems like "a good quality infrared image of the target's face" is hard to get right now only because the tech isn't ubiquitous yet. Wait until every website the user logs into has a copy. https://arstechnica.com/information-technology/2021/07/hackers-got-past-windows-hello-by-tricking-a-webcam/
I should make clear that "something you are" factors have a place in authentication and an even bigger place in identification, and over time my opinions on where to use it has gotten more nuanced than can fit well on social media.