You have to be awake and actually look at the sensor for it to unlock. I've tried to have my iPhone X unlock with my eyes closed, or even open without looking at it, and it will not unlock. It detects when the user actually makes eye contact with the sensor.
That is one of the critiques I made on this claim by Bkav's supposed mask hack. Wired attempted to do the same thing with professionally made masks, or the masks that Apple had made by Hollywood mask makers that were indistinguishable from the actual people. . . and had eyes that moved. The Bkav claims were full of technical gobbledegook that totals to NOTHING. It was the equivalent of a magician's patter, intended to distract from the actual lack of evidence.
There claims on their mask are completely bogus too:
They claim that the nose being made out of silicone somehow makes a difference (Wired tried masks made of silicone along with four other materials), especially when their VP of Cyber Security states that they just sort of cobbled an ad hoc version of their tech's nose together when the accurate 3D printed one didn't work, and that an "artist" applied the skin texture on the rest of the surfaces, as if an artist's interpretation of skin, were somehow better than a machine accurate creation were not.
Bkav claimed they noticed that they could cover half of the user's face and it would iPhone X would still unlock, i.e. only half a face would work. That was the key to creating their mask. I have tried that multiple times on my iPhone X and it DOES NOT WORK. No matter what part of my face I cover with a block, it will not open with half of my face covered. Their claim is BOGUS. The only way it would work is if the TRAINED the phone to work with a half face.
Many critics of their demo are pointing out that on opening the iPhone X, doesn't come open to a normal iPhone lock screen, but instead opens on the passcode entry screen which is NOT at all normal behavior of the OS. In addition, Bkav claims they set FaceID up without a passcode. . . but iOS will NOT permit a user to setup FaceID WITHOUT a safety backup PASSCODE, because if FaceID fails to unlock the device, you must be able to unlock the device with a passcode!
The Demo opens on a passcode screen, prima facie evidence the lied about there being no passcode. . . which you would not see if there were no passcode.
I think all the demo shows is a screen grabbed image of the passcode entry screen and swiping up of the photo app to the home screen of an already runlocked iPhone.