You just disable FaceID in that scenario and go back to using a passcode.

But again if you can't trust your twin well then your phone is the last thing I would be worried about.