You’re right that just scanning a face without checking it against a list of authorized users is pretty mind-bogglingly stupid as far as security measures go, but whatever. It’s not like many of the Empire’s other design decisions make a lot of sense.