FaceID works by scanning your face in 3D with thousands of dots using two cameras to determine depht.
This means you cant trick it with a picture (like other face unlocking technologies) which makes it pretty secure.
Apple is so confident in FaceID, that they straight up removed the fingerprint scanner.
The fingerprint scanner is also very secure. Because it senses (apart from your fingerprint of course) also the fingers conductivity which is only matched by a real finger (this is why your phone doesnt turn on your screen if something touches your fingerprint sensor).
Comments (and upvotes) are greatly appreciated. And I will respond to every comment.
Sources:
Apples presentation
UnboxTherapy
EverythingApplePro
engadget.com