My sister can unlock my phone with FaceID

It is a known aspect of faceID and is documented by Apple - About Face ID advanced technology - Apple Support

”The probability that a random person in the population could look at your iPhone or iPad Pro and unlock it using Face ID is approximately 1 in 1,000,000 with a single enrolled appearance. As an additional protection, Face ID allows only five unsuccessful match attempts before a passcode is required. The statistical probability is different for twins and siblings that look like you and among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate.”

There was a couple of tech news articles at the end of last year and this year about some recent Apple patent filings that may offer technologies to change that though (subepidermal imaging and application of machine learning algorithms). Other companies appear to be developing similar approaches to tighten up face recognition as a secure login.

Yes. This has long been a documented possibility:

About Face ID advanced technology - Apple Support - https://support.apple.com/HT208108