this reminds me of Interactive Broker's iOS MFA.

if someone tries to login and you happen to be using their app, the face ID triggers automatically without prompting you to accept.

you would have to be very fast to point the phone away from your face to avoid it.