State actors would have zero issues lifting a fingerprint off a phone, then making a prop for the sensor. Alternatively all they need is a minor tranquilizer and there you go, provided the human asset is available.
Sorry I was unclear, I meant "cutting fingers" as an example of torture meant to extract passwords, not in the sense that they'd use the finger to unlock the phone.
Face-ID and fingerprints share the same issues compared to a password.