content: The sensors in the phone can be hacked and potentially accessed directly in isolation. Theres nothing preventing the sensor itself from being hijacked and other code being executed on the device to achieve another result or goal. Even if the NSA/CIA can't retain the data, the ability to use the sensor to Face ID someone against their system is a huge risk. I am not arguing this would be easy, it wouldn't be, but the hardware is there. That is what concerns me the most.