The "Cyber security guy" is actually the VP of an Android phone maker who sells a competing phone called the BPhone which uses a fingerprint sensor they claim is better. . . but his demo is a hoax. See a thread on that here with an explanation of why it's bogus:
Face ID beaten by mask, not an effective security measure (with Video)
His mask is a joke looking like the user was swathed in mummy like bandages when he trained his iPhone X. . . and likely was. It has tape like ridges all over it that would make a true 3D sensor raise red flags all over the place.
Both Apple and Wired Magazine, and now the Wall Street Journal used professional accurately made masks that were indistinguishable from the real persons, not amateur jokes like this one, and all failed to unlock the owner's iPhones.
Apple's Hollywood Professionally Made Test Masks
"WE TRIED REALLY HARD TO BEAT FACE ID—AND FAILED (SO FAR)—Wired Magazine's Mask Tests of FaceID
Wall Street's YouTube iPhone X FaceID Testing
Except for Apple, these are independent tests. . . not a self-serving competitor.
Bkav, the phone maker, claimed that they based their hack by noticing that you could cover over 50% of your face and the iPhone would still unlock. That is completely false. I've tried it with various portions of my face 50% covered and my iPhone X WILL NOT UNLOCK. However, if one TRAINS one's iPhone with one's face covered, then it is MUCH more forgiving of a partial face.
No one has been able to replicate his hack using his description of how to do it, despite his claims of how easy it is. . . indicating it is a hoax.
I think that is possibly what that mother and son did. I notice their eyes are very similar. Train the iPhone to recognize only the eyes, and it will unlock for similar eyes.