Sounds like it will only happen if the faces are similar. So if the threshold for matching is 95% match to the internal model, but the faces are 90% similar, and then the new face enters the correct PIN, then the new face will be used to tweak the model, which will move the error to inbetween the features of both. So if their faces are similar to within twice the margin-of-error of the detection algorithm, then you can probably get this effect.

All that said "an untrusted person that uses your PIN" knows your PIN... so they are a trusted person as far as the OS is concerned. There's nothing you can do with FaceID/TouchID that you can't do with the PIN. All FaceID/TouchID do is decrypt the PIN from the secure enclave. So if you've shared your PIN with them, then this is a weird thing, but not actually a security violation.