If you're like me, you probably use your Firefox app to auto fill passwords around your iPhone. The way Firefox secures these passwords are Face ID (which is fine) and then it's backup is your iPhone passcode. The latter is potentially problematic.
This video from the WSJ (https://youtu.be/QUYODQB_2wQ) shows how if someone, for example, records you inputting your passcode over your shoulder, they can steal pretty much everything connected to you.
One way they recommend preventing this is using an external password manager like LastPass, which has the ability to have an additional PIN that is different from your iPhone passcode.
I will also note that other apps, such as my banking app, does not allow you to use the iPhone lock screen password if your Face ID fails, it forces you to enter your bank account password.