Also regarding the "evil twin" thing, evil twins came from another dimension so, aside from the goatee, they really were literally identical down to every last detail. It's unclear to me if that joke was meant as "your identical twin will be able to unlock your phone, so hopefully they aren't evil", or was just meant as "someone who looks like you might be able to unlock your phone". Probably a bit of both. But this is why I want to know what the actual probability is that an identical twin can unlock the phone. Maybe it really is 1 : 1, but maybe it's not.
Maybe it needs to see more "liveliness" and a few degrees head rotation?
Overall I think with the alertness test, the 48-hour passcode lockout, the "press the lock button 5 times" panic mode, and a limit on all attempts is enough to discourage most three letter agencies. It seems to have been enough with TouchID.