No, it's not a bug. It's simply a statistically unlikely but still possible occurrence:
The probability that a random person in the population could look at your iPhone or iPad Pro and unlock it using Face ID is less than 1 in 1,000,000 with a single enrolled appearance whether or not you're wearing a mask. As an additional protection, Face ID allows only five unsuccessful match attempts before a passcode is required. The statistical probability is higher—and further increased if using Face ID with a mask—for twins and siblings that look like you, and among children under the age of 13, because their distinct facial features might not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate. You can also use Face ID without enabling Face ID with a mask.
About Face ID advanced technology - Apple Support