>If you harvested images of Sri Lankans online you would probably need less than a million to get a false positive.

Bearing in mind that FaceID uses a depth map of the face, you'll need more than photos harvested online. They also specifically said that they've tested against realistic masks to make sure they won't work, so I don't think it'll be quite as bad as you imagine!