Apple Face ID is UNSAFE

I grabbed my brother's phone and I was able to access it through Face ID. He does not have me set up on his phone as an alternate Face ID. We are not twins. Both of us can access his phone. This makes me question Apple's security measures. Apple brags about the methods they use to protect company and client information but in this particular case, these measurements have not been met. Any insight on this?