My friend is able to unlock my iPhone XR Face ID with his face while the registered Face ID is mine

Not uncommon for younger users to bypass face id.

Use a strong passcode.

Be sure you are not in view of the phone when your friend unlocks it. Another room is best. The FaceID system will find you if you can be "seen" by the front of your phone, meaning that if you can see the screen it can see you.

The next step is to delete your Face ID and re-scan it.